CVE-2026-56285

Name of the Vulnerable Software and Affected Versions Nitter (affected versions not specified)

Description The '/video' media proxy endpoint fails to validate target URLs against Twitter/X domains and utilizes a hardcoded default HMAC key. This allows unauthenticated attackers to compute valid HMACs (Hash-based Message Authentication Codes, used to verify data integrity and authenticity) for arbitrary URLs. Consequently, attackers can retrieve HTTP responses from any host reachable by the server, including internal network resources and cloud metadata services.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.