LOW 2.3 NVD
CVE-2026-123207
LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed() by exploiting unpin
LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed() by exploiting unpinned DNS resolution in fetchWithSafeRedirects(). Attackers controlling authoritative DNS can return public addresses during validation and internal addresses at connection time via /api/source/test, /api/proxy, /api/search or /api/detail to reach loopback services, private hosts or cloud metadata endpoints.
References
- https://github.com/LibreSpark/LibreTV/blob/29cbeb3d37b4876f909a0354087a3531af0447f6/src/li
- https://github.com/LibreSpark/LibreTV/commit/cb4219368b7f6502387a703ef2a781ba763da2b1
- https://github.com/LibreSpark/LibreTV/issues/941
- https://github.com/LibreSpark/LibreTV/pull/960
- https://github.com/LibreSpark/LibreTV/releases/tag/v2.21.2
This low severity vulnerability with a CVSS score of 2.3 was published on 2026-11-05 via NVD.
vulnfeed aggregates 16740 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.