EUVD-2026-40154
GHSA-4m2j-2x3w-gg93
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network SSRF against default config (PR:N/AC:L); scope changes (S:C) as the server reads other systems, and metadata/internal data exposure makes C:H with no integrity or availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated attackers to compute valid HMACs for arbitrary URLs. Attackers can retrieve HTTP responses from any host reachable by the server, including cloud metadata services and internal network resources.
AnalysisAI
Server-side request forgery in Nitter's /video media proxy endpoint lets unauthenticated remote attackers coerce the server into fetching arbitrary URLs and returning their HTTP responses, including AWS/GCP cloud metadata endpoints and internal-only network resources. The flaw stems from two compounding errors: the proxy never validates that target URLs belong to Twitter/X domains, and it ships with a hardcoded default HMAC signing key, so an attacker can locally compute the valid HMAC signature required for any URL of their choosing. No public exploit has been identified at time of analysis, but the technical details and the fixing commit are public.
Technical ContextAI
Nitter is a free, open-source alternative front-end for Twitter/X that proxies media (images and video) through its own server so clients never contact Twitter directly. The /video endpoint is intended to fetch media only from Twitter/X CDN hosts and uses an HMAC signature to authorize proxy requests. The root cause is CWE-918 (Server-Side Request Forgery): the endpoint authorizes requests purely on a valid HMAC and never enforces an allowlist of permitted destination domains. Because the HMAC key defaults to a value hardcoded in the source (zedeus/nitter), any operator who did not override it uses a publicly known secret, letting an attacker forge signatures for non-Twitter URLs. The server then performs the outbound request from its own network position and relays the response body back to the attacker, which is the classic SSRF pivot into link-local metadata services (e.g. 169.254.169.254) and RFC1918 internal hosts.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply the change in commit 44b2f096f67da2cc257a0e262a94a7ae79e95d47 (https://github.com/zedeus/nitter/commit/44b2f096f67da2cc257a0e262a94a7ae79e95d47) by rebuilding/redeploying from a Nitter build that includes it. Independently of patching, immediately override the default HMAC key in nitter.conf with a long random secret so forged signatures stop validating; this alone neutralizes the signature-forgery vector and has no functional downside. As compensating controls where you cannot patch immediately: block the Nitter server's outbound access to the cloud metadata IP (169.254.169.254) and to RFC1918/internal ranges via host firewall or egress proxy (trade-off: must whitelist Twitter/X CDN hosts so legitimate media still loads); and on AWS enforce IMDSv2 to require a session token, which defeats the simple GET-based metadata read (trade-off: any tooling relying on IMDSv1 breaks). Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/nitter-server-side-request-forgery-in-video-media-proxy-endpoint) for confirmation of the fix.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today