LibreTV before version 2.21.2 contains a server‑side request forgery vulnerability that allows an authenticated user to bypass the checkUpstreamAllowed guard by exploiting unpinned DNS resolution in fetchWithSafeRedirects. Attackers who control authoritative DNS can return a public IP address during the initial validation and then cause the request to resolve to a private, loopback, or cloud‑metadata address when the connection is made. This enables the server to reach internal services that the authenticated user has permission to contact, potentially exposing sensitive data or facilitating further internal exploitation.

The vulnerability affects LibreSpark’s LibreTV product in all releases before v2.21.2. Exposed endpoints that contain the unsafe redirect logic include /api/source/test, /api/proxy, /api/search, and /api/detail. Administrators should identify any of these services that are publicly reachable and determine the set of authenticated users who can invoke them.

The CVSS score is 2.3, indicating a low overall severity. No EPSS score is published, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires legitimate credentials to access the vulnerable API routes, so the risk is primarily to systems where such credentials are already compromised or widely available. While the ability to reach cloud‑metadata or internal back‑ends can lead to data exposure, the necessity of authentication limits the likelihood of widespread exploitation. In the absence of existing exploits, the threat remains moderate but should be mitigated promptly.