zedeus/nitter vulnerabilities

Latest zedeus/nitter CVEs

Newest publication first

1. CVE-2026-56285 Nitter - Server-Side Request Forgery in /video Media Proxy Endpoint

   Published 2026-06-29

   High·CVSS 7.7 EPSS 0.46%

   Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated attackers to compute valid HMACs for arbitrary URLs. Attackers can retrieve HTTP responses from any host reachable by the s...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.