Vulnerability · Published Sep 4, 2026 · Assigned by VulnCheck

CVE-2026-85608Douyin_TikTok_Download_API 4.1.2 SSRF via url parameter

High 7.5

In plain English

A high-severity server-side request forgery in Douyin_TikTok_Download_API from Evil0ctal. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 57.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Douyin_TikTok_Download_API through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /api/hybrid/video_data endpoints that allows unauthenticated attackers to fetch arbitrary URLs by supplying a url query parameter. Attackers can request internal services including cloud metadata endpoints and retrieve response bodies containing sensitive credentials through error messages.

Affected products (as reported)

Vendor	Product	Versions
Evil0ctal	Douyin_TikTok_Download_API	0 – through 4.1.2

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Issue #729 issue-tracking
https://github.com/Evil0ctal/Douyin_TikTok_Download_API product
https://github.com/Evil0ctal/Douyin_TikTok_Download_API/blob/V4.1.2/crawlers/douyin/web/utils.py technical-description
VulnCheck Advisory: Douyin_TikTok_Download_API 4.1.2 SSRF via url parameter third-party-advisory