Server-Side Request Forgery in Nitter's Video Media Proxy Endpoint

CVE-2026-56285

What is CVE-2026-56285?

The Nitter video media proxy endpoint is susceptible to a Server-Side Request Forgery vulnerability due to improper validation of target URLs. This flaw permits unauthenticated attackers to craft valid HMACs for arbitrary URLs, potentially leading to the exposure of sensitive data from any accessible host, including cloud metadata services and internal resources. The vulnerability arises from the use of a hardcoded default HMAC key, which further exacerbates the risk by allowing unauthorized parties access to resources that should remain secure. Immediate action is required to safeguard against this security threat.

References