CVE-2026-123207

3.1 LOWpublic exploit available

Published 2026-11-05 · Updated 2026-11-05

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed() by exploiting unpinned DNS resolution in fetchWithSafeRedirects(). Attackers controlling authoritative DNS can return public addresses during validation and internal addresses at connection time via /api/source/test, /api/proxy, /api/search or /api/detail to reach loopback services, private hosts or cloud metadata endpoints.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-367

Public exploit & PoC references

https://github.com/LibreSpark/LibreTV/blob/29cbeb3d37b4876f909a0354087a3531af0447f6/src/lib/ssrf.ts#L56-L85
https://github.com/LibreSpark/LibreTV/commit/cb4219368b7f6502387a703ef2a781ba763da2b1
https://github.com/LibreSpark/LibreTV/issues/941
https://github.com/LibreSpark/LibreTV/pull/960
https://github.com/LibreSpark/LibreTV/releases/tag/v2.21.2

All references

https://github.com/LibreSpark/LibreTV/blob/29cbeb3d37b4876f909a0354087a3531af0447f6/src/lib/ssrf.ts#L56-L85
https://github.com/LibreSpark/LibreTV/commit/cb4219368b7f6502387a703ef2a781ba763da2b1
https://github.com/LibreSpark/LibreTV/issues/941
https://github.com/LibreSpark/LibreTV/pull/960
https://github.com/LibreSpark/LibreTV/releases/tag/v2.21.2
https://www.vulncheck.com/advisories/libretv-before-2.21.2-ssrf-protection-bypass-via-dns-rebinding

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2025-68404
UNSCOREDCVE-2026-100235
HIGHCVE-2026-100597PoC
HIGHCVE-2026-100713PoC
MEDIUMCVE-2026-101029PoC
MEDIUMCVE-2026-101088PoC
MEDIUMCVE-2026-101308
MEDIUMCVE-2026-102354PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.