EUVD-2026-71224
GHSA-frfv-49qc-79r8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Scope changed because SSRF reaches resources outside the vulnerable component (internal services, IMDS); C:H because full cloud credentials are disclosed to the attacker.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Douyin_TikTok_Download_API through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /api/hybrid/video_data endpoints that allows unauthenticated attackers to fetch arbitrary URLs by supplying a url query parameter. Attackers can request internal services including cloud metadata endpoints and retrieve response bodies containing sensitive credentials through error messages.
AnalysisAI
Server-side request forgery in Douyin_TikTok_Download_API through version 4.1.2 exposes internal network resources and cloud instance credentials to unauthenticated remote attackers. The /api/download and /api/hybrid/video_data endpoints accept a user-supplied url query parameter without validation, allowing any caller to instruct the server to fetch arbitrary URLs - including cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254) - and read back full response bodies or error messages containing sensitive credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required for SSRF to internal URLs: the endpoints /api/download and /api/hybrid/video_data accept the url parameter from any unauthenticated HTTP caller with no authentication, API key, or session required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 with VC:H reflects the high confidentiality impact accurately: successful exploitation on a cloud-hosted instance can yield IAM access keys, session tokens, and role credentials, leading to full cloud account compromise as a secondary consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis; the disclosure references a GitHub issue (#729) but no corresponding fix commit or tagged release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all deployments of Douyin_TikTok_Download_API version 4.1.2 or earlier in production and development; verify which instances have outbound access to cloud metadata endpoints (169.254.169.254) and internal networks; disable /api/download and /api/hybrid/video_data endpoints immediately if not operationally critical, or restrict network access to trusted callers only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today