CVE-2026-56285: Nitter Media Proxy SSRF and Hardcoded HMAC Key Vulnerability

Technical summary

The /video endpoint in Nitter's media proxy does not properly validate target URLs against an allowlist of legitimate Twitter/X domains (CWE-1188: Insecure Default Variable Initialization). Instead, it accepts arbitrary URLs after validation is bypassed. The service uses a hardcoded HMAC secret key for request authentication, which is identical across all Nitter instances and publicly discoverable. This enables Server-Side Request Forgery (SSRF) attacks (CWE-918). An attacker can compute a valid HMAC using the default key, construct a request targeting an internal resource or cloud metadata endpoint (e.g., AWS IMDSv2, GCP metadata, Kubernetes API), and retrieve the HTTP response. The proxy will execute the request on behalf of the attacker, exfiltrating sensitive data that would otherwise remain isolated from the internet.

Business impact

Organizations running Nitter internally or relying on Nitter instances for public Twitter/X content access face significant data exfiltration risk. Attackers can extract AWS credentials, API keys, environment secrets, and other sensitive metadata from cloud environments. Corporate networks may expose internal service enumeration, configuration details, and even authentication tokens stored in internal registries or configuration systems. For public-facing Nitter instances, attackers can harvest any data accessible from the server's network vantage point. Additionally, the proxy could be weaponized for scanning internal networks or launching attacks on previously unknown internal services. Incident response and forensic efforts may be complicated by the ease of exploitation and the likelihood of widespread abuse before detection.

Affected systems

All Nitter installations are affected, regardless of version, as the vulnerability is rooted in the core design of the media proxy feature. Nitter is a lightweight, privacy-respecting alternative to Twitter/X and is commonly self-hosted by individuals, organizations, and privacy advocates. Organizations should inventory any internal or externally-facing Nitter instances. The severity increases if Nitter is deployed in cloud environments with privileged IAM roles or in network segments with access to sensitive internal systems, databases, or credential stores.

Exploitability

This vulnerability is trivial to exploit. No authentication is required, the attack surface is immediate upon network access, and the hardcoded default key is not environment-specific, making it reproducible across all instances. An attacker needs only basic HTTP client capabilities and knowledge of the default HMAC key to craft a valid request. Proof-of-concept is straightforward: compute an HMAC-SHA256 signature over a target URL using the hardcoded key, send a request to the /video endpoint with the signature, and receive the proxied response. The attack requires no special timing, no user interaction, and no prior reconnaissance. Public disclosure of the vulnerability will accelerate weaponization.

Remediation

Immediate action is required for all Nitter deployments. The primary fix is to disable or remove the /video media proxy endpoint entirely if it is not essential to your use case. If the proxy must be retained, a patched version must regenerate the HMAC key using a cryptographically secure, instance-specific value and implement strict URL validation to allow only requests targeting Twitter/X domains. Organizations should consult the official Nitter project repository for a patched release; verify against the vendor advisory before deploying. Until patching is possible, isolate Nitter instances from networks containing sensitive resources and implement network-level controls (WAF rules, IP restrictions) to limit proxy endpoint access. Rotate any credentials or API keys that may have been exposed through the proxy.

Patch guidance

Monitor the official Nitter GitHub repository and project security advisories for a patched release addressing this vulnerability. The fix must include: (1) removal or cryptographically hardened replacement of the default HMAC key with per-instance, securely-generated alternatives; (2) implementation of a strict URL allowlist permitting only requests to Twitter/X domains; and (3) validation that URL parsing cannot be bypassed (e.g., via URL encoding tricks or redirect chains). When a patch becomes available, prioritize deployment on any Nitter instance exposed to the internet or located in cloud environments. Test the patch in a non-production environment to confirm the /video endpoint rejects requests to non-Twitter/X hosts. Consider whether your organization actually requires the media proxy feature; if not, disable it permanently.

Detection guidance

Monitor access logs for requests to the /video endpoint with suspicious target parameters. Look for requests containing internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost addresses, cloud metadata endpoints (169.254.169.254, metadata.google.internal, 100.100.100.200), or Kubernetes API endpoints (kubernetes.default). Implement alerting on 2xx responses from the /video endpoint to non-Twitter/X domains. Network-level detection should flag outbound connections from Nitter instances to unusual destinations (cloud metadata services, internal databases, private API endpoints). If forensic analysis is needed, examine proxy logs for HMAC signatures—any valid signature with the default key indicates either exploitation or misconfiguration.

Why prioritize this

With a CVSS score of 8.6 (HIGH) and demonstrated ease of exploitation, this vulnerability warrants urgent remediation. The combination of no authentication requirement, no user interaction, and broad network impact (accessing resources beyond the immediate network boundary) elevates risk. The vulnerability is not yet included in CISA's Known Exploited Vulnerabilities catalog, but early disclosure and simplicity of exploitation make widespread abuse inevitable. Any organization running Nitter in sensitive environments should treat this as a critical patch candidate. Delay increases the window of exposure for credential theft and lateral movement.

Risk score, explained

The CVSS 3.1 score of 8.6 reflects: (1) network-accessible attack vector with low complexity; (2) no authentication or user interaction required; (3) high confidentiality impact due to exfiltration of sensitive data across trust boundaries; (4) cross-origin/cross-system scope (the attacker can pivot from the vulnerable service to internal or cloud infrastructure). The lack of integrity or availability impact (the attacker cannot modify or destroy data) prevents a critical rating, but the confidentiality breach is severe. The score does not capture the organizational risk amplified by Nitter's prevalence in privacy-focused deployments where it may run with elevated privileges or in trusted network positions.

Frequently asked questions