CVE-2026-123207

LibreTV before version v2.21.2 is vulnerable to a server-side request forgery (SSRF) protection bypass via DNS rebinding . The flaw exists in the fetchWithSafeRedirects() function, where unpinned DNS resolution allows an attacker to bypass the checkUpstreamAllowed() check. By controlling an autho...