CVE detail
CVE-2026-56285
Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated attackers to compute valid HMACs for arbitrary URLs. Attackers can retrieve HTTP responses from any host reachable by the server, including cloud metadata services and internal network resources.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 13.9 · diversity 6.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 3
- within the 30d window
- Peak daily
- 3
- highest bucket
Evidence
Source links by recency
3 source links · newest first
- https://www.vulncheck.com/advisories/nitter-server-side-request-forgery-in-video-media-proxy-endpointwww.vulncheck.com
No excerpt available.
Exploitwww.vulncheck.comJun 29, 2026, 6:16 PM No excerpt available.
Exploitgithub.comJun 29, 2026, 6:16 PMNo excerpt available.
Exploitgithub.comJun 29, 2026, 6:16 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-43527CVSS 6.3 · Medium
OpenClaw before 2026.4.14 contains a server-side request forgery vulnerability in browser SSRF policy that allows private-network navigation by default. Attackers can exploit this…
- CVE-2026-31818CVSS 9.6 · Critical
Budibase is an open-source low-code platform. Prior to version 3.33.4, a server-side request forgery (SSRF) vulnerability exists in Budibase's REST datasource connector. The platf…
- CVE-2026-65925CVSS 6.5 · Medium
A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response.
- CVE-2026-65924CVSS 6.5 · Medium
JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authenticated user - or, if anonymous access is e…
- CVE-2026-65923CVSS 6.8 · Medium
A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended server-side request…
- CVE-2026-65618CVSS 6.5 · Medium
Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing inter…