https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T20:01:37.305096+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-56285 CVE-2026-56285 — Nitter - Server-Side Request Forgery in /video Media Proxy Endpoint 2026-10-09T20:01:37.306265+00:00

Affected: zedeus nitter

Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated attackers to compute valid HMACs for arbitrary URLs. Attackers can retrieve HTTP responses from any host reachable by the server, including cloud metadata services and internal network resources.