CVE-2026-85608
Received Received - Intake

Server-Side Request Forgery in Douyin TikTok Download API

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
Douyin_TikTok_Download_API through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /api/hybrid/video_data endpoints that allows unauthenticated attackers to fetch arbitrary URLs by supplying a url query parameter. Attackers can request internal services including cloud metadata endpoints and retrieve response bodies containing sensitive credentials through error messages.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85608
EUVD
EUVD-2026-71224

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
evil0ctal douyin_tiktok_download_api 4.1.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85608 is a server-side request forgery (SSRF) vulnerability in the Douyin_TikTok_Download_API through version 4.1.2. It affects the /api/download and /api/hybrid/video_data endpoints, allowing unauthenticated attackers to fetch arbitrary URLs by supplying a url query parameter. Attackers can request internal services and retrieve sensitive credentials through error messages.

Detection Guidance

Check if your Douyin_TikTok_Download_API instance is running version 4.1.2 or earlier. Test the /api/download and /api/hybrid/video_data endpoints by sending requests with a url parameter pointing to internal or external services. Monitor for unexpected outbound requests or error messages containing sensitive data.

Impact Analysis

This vulnerability allows attackers to access internal services and retrieve sensitive credentials, potentially leading to unauthorized access, data leakage, or further exploitation of internal systems. It could also be used to bypass security controls or exfiltrate sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized disclosure of personal or health information, and non-compliance with regulatory obligations.

Mitigation Strategies

Upgrade to the latest version of Douyin_TikTok_Download_API beyond 4.1.2. Restrict access to the /api/download and /api/hybrid/video_data endpoints via firewall rules. Disable unauthenticated access if possible. Monitor network traffic for suspicious SSRF attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85608. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart