TI-2026-40650 CVE-2026-56285 · GHSA-4m2j-2x3w-gg93
Nitter - Server-Side Request Forgery in /video Media Proxy Endpoint
Priority HIGH 73
Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated attackers to compute valid HMACs for arbitrary URLs.