CVE-2026-85608

Douyin_TikTok_Download_API through version 4.1.2 is vulnerable to server-side request forgery (CWE-918) in its /api/download and /api/hybrid/video_data endpoints. An unauthenticated attacker can supply an arbitrary value in the url query parameter, causing the server to make requests to attacker-chosen destinations, including internal services and cloud provider metadata endpoints (e.g., 169.254.169.254). Because response content is reflected back through error messages, the attacker can read the bodies of those internal responses and extract sensitive data such as cloud instance credentials. Any operator running an affected version is exposed, with the greatest risk for instances reachable from the internet or running on cloud infrastructure with metadata services available. Exploitation has not been observed or publicly demonstrated: there is no known public proof-of-concept, the CVE is not in CISA KEV, and EPSS estimates only a 0.5% probability of exploitation in the next 30 days.

What to do: Upgrade to a release newer than 4.1.2 as soon as a patched version is available. Until then, restrict access to the API (authentication or network allowlisting), block egress from the service to cloud metadata endpoints such as 169.254.169.254, and validate/allowlist the url parameter to approved hosts and schemes; check logs for unexpected requests to /api/download and /api/hybrid/video_data with internal or metadata URLs.