CVE-2026-56285 is a high-severity SSRF vulnerability in the zedeus nitter product. The /video media proxy endpoint fails to restrict target URLs to Twitter/X domains and relies on a hardcoded default HMAC key. This flaw enables unauthenticated attackers to compute valid HMACs for arbitrary URLs, thereby allowing them to make the server fetch HTTP responses from any reachable host. This includes sensitive internal network resources and cloud metadata services, potentially exposing sensitive information or enabling further attacks. No official remediation or patch information is currently available.

An attacker can exploit this SSRF vulnerability to retrieve HTTP responses from any host accessible by the vulnerable server. This can lead to unauthorized access to internal network resources and cloud metadata services, which may contain sensitive data or credentials. The vulnerability does not require authentication and has a high severity score (CVSS 7.7), indicating significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access for the vulnerable service to limit outbound requests. Monitor for unusual outbound traffic patterns originating from the server. Avoid exposing the vulnerable endpoint to untrusted users if possible.