Nitter's /video media proxy endpoint lacks validation of target URLs and uses a hard‑coded default HMAC key. This flaw lets an unauthenticated user compute a valid signature for any URL and retrieve HTTP responses from any host the server can reach, including internal network resources and cloud metadata services.

The affected product is Nitter, a self‑hosted X/Twitter front‑end maintained by zedeus. No specific affected versions are documented in the advisory; the issue applies to any unpatched installation that still uses the vulnerable /video endpoint.

With a CVSS base score of 7.7, the vulnerability is considered high severity. The lack of authentication and the ability to forge HMACs make exploitation trivial for an attacker who can craft a request to the /video endpoint. Although the EPSS score is not available, the direct attack path and potential exposure of internal services indicate a significant risk. The vulnerability is not listed in CISA KEV, but its impact on internal infrastructure warrants immediate attention.