CVE-2026-56285 is an SSRF vulnerability in the nitter product by zedeus. The issue arises because the /video media proxy endpoint does not validate that target URLs belong to Twitter/X domains and uses a hardcoded default HMAC key. This enables unauthenticated attackers to compute valid HMACs for arbitrary URLs, allowing them to retrieve HTTP responses from any host reachable by the server, including sensitive internal and cloud metadata endpoints. The vulnerability is publicly known but no official fix or patch has been published as of the data provided.

An attacker can exploit this vulnerability to perform SSRF attacks, potentially accessing internal network resources and cloud metadata services that should be protected from external access. This can lead to unauthorized information disclosure and may facilitate further attacks within the internal network environment. The vulnerability requires no authentication and has a low attack complexity, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting network access from the nitter server to sensitive internal and cloud metadata endpoints as a temporary mitigation. Avoid exposing the vulnerable endpoint publicly if possible.