CVE-2026-85608: Server-Side Request Forgery (SSRF) in Evil0ctal Douyin_TikTok_Download_API

CVE-2026-85608 is a server-side request forgery vulnerability affecting Evil0ctal's Douyin_TikTok_Download_API through version 4.1.2. The vulnerability exists in the /api/download and /api/hybrid/video_data endpoints, where an unauthenticated attacker can supply a crafted url query parameter to cause the server to make arbitrary HTTP requests. This can be exploited to access internal services, including cloud metadata endpoints, potentially exposing sensitive credentials via error message responses. The CVSS 4.0 base score is 8.7, indicating a high severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality.

An attacker can leverage this SSRF vulnerability to make the server request arbitrary URLs, including internal cloud metadata services. This can lead to disclosure of sensitive information such as credentials contained in response bodies or error messages. The vulnerability does not require authentication or user interaction, increasing the risk of exploitation. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoints if possible and monitor for unusual outbound requests from the server. Avoid exposing internal services to the vulnerable API endpoints.