CVE-2026-56285: Nitter SSRF Vulnerability

CVE-2026-56285 Overview

CVE-2026-56285 is a Server-Side Request Forgery (SSRF) vulnerability in Nitter, an alternative front-end for Twitter/X. The /video media proxy endpoint fails to validate target URLs against Twitter/X domains. It also relies on a hardcoded default HMAC key (secretkey) in the shipped configuration. Unauthenticated attackers can compute valid HMAC signatures for arbitrary URLs and force the server to fetch them. The flaw is tracked under CWE-918.

Critical Impact
Remote unauthenticated attackers can retrieve HTTP responses from any host reachable by the Nitter server, including cloud metadata services (e.g., AWS IMDS at 169.254.169.254) and internal network resources.

Affected Products

Nitter (upstream zedeus/nitter) instances using the default configuration
Deployments where hmacKey in nitter.conf retains the shipped value secretkey
Self-hosted Nitter instances exposing the /video proxy endpoint to the internet

Discovery Timeline

2026-06-29 - CVE-2026-56285 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-56285

Vulnerability Analysis

Nitter proxies media through the /video endpoint to hide upstream Twitter/X requests from the client. Each proxied URL is signed with an HMAC to prevent tampering. Two design defects combine to enable SSRF. First, the endpoint accepts any URL after HMAC verification without restricting the destination to Twitter/X hosts. Second, the shipped nitter.example.conf contains a placeholder key many operators never change. An attacker who knows this key can forge signatures for arbitrary URLs and have Nitter fetch them server-side.

Root Cause

The root cause is missing destination allow-listing combined with a predictable secret. The proxy trusts the HMAC as sole authorization, and the HMAC secret is a well-known default value distributed in the source tree. There is no domain validation step comparing the parsed host against permitted Twitter/X domains before the outbound request executes.

Attack Vector

The attack is remote, unauthenticated, and low-complexity. An attacker computes HMAC-SHA256(secretkey, target_url), appends it to a crafted /video request, and reads the response body returned by Nitter. Targets include cloud instance metadata endpoints, internal admin panels, and localhost services bound to the Nitter host.

text

# Patch excerpt from nitter.example.conf
[Config]
-hmacKey = "secretkey"        # random key for cryptographic signing of video urls
+hmacKey = "secretkey"        # CHANGE THIS to a unique random value (e.g. `openssl rand -hex 32`); signs media urls
 base64Media = false          # use base64 encoding for proxied media urls

Source: GitHub commit 44b2f096. The patch updates the configuration comment to instruct operators to replace the default key. Operators must also apply destination validation from the referenced commit.

Detection Methods for CVE-2026-56285

Indicators of Compromise

Outbound HTTP requests from the Nitter server process to non-Twitter/X hosts, particularly 169.254.169.254, metadata.google.internal, or RFC1918 ranges.
Access log entries on /video where the decoded URL parameter does not resolve to a twimg.com, video.twimg.com, or pbs.twimg.com host.
Unexpected DNS lookups originating from the Nitter host for internal or cloud metadata domains.

Detection Strategies

Parse Nitter access logs and alert on /video requests whose target URL host is not in the Twitter/X allow list.
Correlate the Nitter process network telemetry with destination IPs to flag requests to link-local and private address ranges.
Baseline expected upstream hosts for the Nitter binary and alert on deviations using EDR process-to-network correlation.

Monitoring Recommendations

Enable egress logging on the Nitter host and forward to a central SIEM with retention sufficient for incident response.
Monitor for authentication anomalies on cloud metadata services that could indicate credential theft following SSRF.
Review web application firewall (WAF) logs for high volumes of /video?url= requests from single sources.

How to Mitigate CVE-2026-56285

Immediate Actions Required

Replace the hmacKey value in nitter.conf immediately with a cryptographically random value generated via openssl rand -hex 32.
Update Nitter to the commit that adds Twitter/X domain validation on the /video proxy endpoint or later.
Restart the Nitter service after configuration changes so cached signatures using the old key are invalidated.
Block egress from the Nitter host to cloud metadata endpoints and internal management networks at the network layer.

Patch Information

The upstream fix is available in zedeus/nitter commit 44b2f096. Community discussion is tracked in GitHub issue #1411. Additional advisory details are published by VulnCheck. Operators must both apply the code patch and rotate hmacKey; the code patch alone does not remediate instances that continue using the default key if any bypass emerges.

Workarounds

Deploy Nitter behind a reverse proxy that rejects /video requests whose decoded url parameter host is not on a strict Twitter/X allow list.
Run the Nitter process in a network namespace or container with egress restricted to Twitter/X CDN IP ranges only.
Use IMDSv2 with hop-limit 1 on AWS, and require header-based authentication on GCP metadata to reduce SSRF impact.

bash

# Generate a strong hmacKey and update nitter.conf
NEW_KEY=$(openssl rand -hex 32)
sed -i "s/^hmacKey = .*/hmacKey = \"${NEW_KEY}\"/" /etc/nitter/nitter.conf
systemctl restart nitter

# Example egress restriction with iptables (block cloud metadata)
iptables -A OUTPUT -m owner --uid-owner nitter -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner nitter -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner nitter -d 192.168.0.0/16 -j REJECT