Summary
CVE-2026-56285 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in Nitter (zedeus/nitter), an open-source privacy-focused alternative frontend for Twitter/X, affecting all commits prior to 44b2f096f67da2cc257a0e262a94a7ae79e95d47. The flaw carries a CVSS 3.1 score of 8.6 (HIGH). Two compounding weaknesses — a missing URL domain validation check on the /video media proxy endpoint and a publicly documented hardcoded default HMAC signing key — allow an unauthenticated remote attacker to cause the Nitter server to fetch and return HTTP responses from any host reachable by the server, including cloud metadata services and internal network resources.
Technical details
- Root cause 1 – Missing domain validation: The
/videomedia proxy endpoint (/video/<hmac>/<url>) only performs a weak substring check ("http" in url) and does not validate that the target URL belongs to a Twitter/X domain. This is in contrast to Nitter’s/picendpoint, which does enforce aisTwitterUrl()domain allowlist check. - Root cause 2 – Insecure default HMAC key: Nitter ships with a hardcoded default HMAC signing key of
secretkey, documented directly innitter.example.confwith a comment instructing operators to replace it. Instances that have never changed this default allow any attacker to compute cryptographically valid signatures for arbitrary target URLs. - Trigger conditions: No authentication, no special privileges, and no user interaction are required. An attacker needs only network access to the exposed Nitter instance and knowledge of the default key value, which is publicly visible in the repository.
- Attack vector: The attacker computes a valid HMAC signature over an arbitrary target URL using the default key (
secretkey), then issues a single HTTP GET request to/video/<computed_hmac>/<arbitrary_url>on the Nitter server. - Impact: The Nitter server fetches the attacker-controlled URL and returns the full HTTP response body to the attacker. This enables direct retrieval of data from cloud instance metadata endpoints (e.g., AWS IMDSv1 at
169.254.169.254), internal services, and any other host reachable by the server — creating a practical path to cloud credential theft, internal service enumeration, and lateral movement within the hosting environment.
Affected software
- Nitter (zedeus/nitter): All commits prior to
44b2f096f67da2cc257a0e262a94a7ae79e95d47
Severity
CVSS v3.1 base score: 8.6 (HIGH)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Mitigation and recommended actions
- Patch: Update Nitter to commit
44b2f096f67da2cc257a0e262a94a7ae79e95d47or any later commit. This patch adds Twitter/X domain validation to the/videoendpoint, mirroring the existing protection on the/picendpoint, and introduces a startup warning when the default HMAC key is still in use. - Immediate workaround (if patching is not yet possible): Rotate the
hmacKeyvalue innitter.confto a unique, randomly generated secret (e.g., generated viaopenssl rand -hex 32). This prevents unauthenticated attackers from computing valid proxy signatures for arbitrary URLs even before the domain-validation patch is applied. - Network mitigation: Block outbound connections from the Nitter server to cloud instance metadata endpoints (e.g.,
169.254.169.254) at the host or network firewall level, and restrict outbound HTTP/HTTPS to only the Twitter/X domains required for operation.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.