CVE-2026-85608

DouyinTikTokDownloadAPI through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /api/hybrid/videodata endpoints that allows unauthenticated attackers to fetch arbitrary URLs by supplying a url query parameter. Attackers can request internal services including...

CVE-2026-85608 Douyin_TikTok_Download_API 4.1.2 SSRF via url parameter

DouyinTikTokDownloadAPI through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /api/hybrid/videodata endpoints that allows unauthenticated attackers to fetch arbitrary URLs by supplying a url query parameter. Attackers can request internal services including...

CVE-2026-85608

Douyin_TikTok_Download_API (through version 4.1.2 ) is vulnerable to server-side request forgery (SSRF) in the /api/download and /api/hybrid/video_data endpoints. An unauthenticated attacker can supply an arbitrary url query parameter to make the server fetch internal resources, including cloud m...