CVE-2026-85608: Douyin_TikTok_Download_API 4.1.2 SSRF via url parameter
DouyinTikTokDownloadAPI through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /api/hybrid/videodata endpoints that allows unauthenticated attackers to fetch arbitrary URLs by supplying a url query parameter. Attackers can request internal services including cloud metadata endpoints and retrieve response bodies containing sensitive credentials through error messages.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments of Douyin_TikTok_Download_API through version 4.1.2 are affected if the /api/download or /api/hybrid/video_data endpoints are reachable by an attacker. No authentication is required to use the vulnerable url query parameter.
What can an attacker access through the flaw?
An attacker can cause the server to fetch arbitrary URLs, including internal services and cloud metadata endpoints. Response bodies may be exposed in error messages, potentially disclosing sensitive credentials.
How can I determine whether my instance is being targeted or has been exploited?
Review requests to /api/download and /api/hybrid/video_data for attacker-controlled url query values, particularly URLs targeting private or internal addresses or cloud metadata services. Also inspect application error messages for returned content from those requests.