CVE-2026-123207 is a server-side request forgery (SSRF) vulnerability in LibreTV versions before 2.21.2. It arises from a time-of-check to time-of-use (TOCTOU) race condition in DNS resolution within the fetchWithSafeRedirects() function. Authenticated users can exploit this flaw by manipulating DNS responses to bypass upstream address validation and access internal network services via specific API endpoints.