LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed() by exploiting unpinned DNS resolution in fetchWithSafeRedirects(). Attackers controlling authoritative DNS can return public addresses during validation and internal addresses at connection time via /api/source/test, /api/proxy, /api/search or /api/detail to reach loopback services, private hosts or cloud metadata endpoints.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Librespark
  • Libretv

No data.

No data.

References
Link Providers
https://github.com/LibreSpark/LibreTV/blob/29cbeb3d37b4876f909a0354087a3531af0447f6/src/lib/ssrf.ts#L56-L85 cve-icon cve-icon cve-icon
https://github.com/LibreSpark/LibreTV/commit/cb4219368b7f6502387a703ef2a781ba763da2b1 cve-icon cve-icon cve-icon
https://github.com/LibreSpark/LibreTV/issues/941 cve-icon cve-icon cve-icon
https://github.com/LibreSpark/LibreTV/pull/960 cve-icon cve-icon cve-icon
https://github.com/LibreSpark/LibreTV/releases/tag/v2.21.2 cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-123207 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-123207 cve-icon
https://www.vulncheck.com/advisories/libretv-before-2.21.2-ssrf-protection-bypass-via-dns-rebinding cve-icon cve-icon cve-icon
History

Thu, 12 Nov 2026 01:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 06 Nov 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Librespark
Librespark libretv
Vendors & Products Librespark
Librespark libretv

Fri, 06 Nov 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-918
References
Metrics threat_severity

None

 threat_severity

Low

Thu, 05 Nov 2026 18:30:00 +0000

Type Values Removed Values Added
Description LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed() by exploiting unpinned DNS resolution in fetchWithSafeRedirects(). Attackers controlling authoritative DNS can return public addresses during validation and internal addresses at connection time via /api/source/test, /api/proxy, /api/search or /api/detail to reach loopback services, private hosts or cloud metadata endpoints.
Title LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding
Weaknesses CWE-367
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-11-05T18:16:41.817Z

Updated: 2026-11-09T22:31:55.618Z

Reserved: 2026-11-05T17:58:52.271Z

Link: CVE-2026-123207

cve-icon Vulnrichment

Updated: 2026-11-09T22:31:43.939Z

cve-icon NVD

Status : Deferred

Published: 2026-11-05T19:17:20.217

Modified: 2026-11-12T21:09:09.470

Link: CVE-2026-123207

cve-icon Redhat

Severity : Low

Publid Date: 2026-11-05T18:16:41Z

Links: CVE-2026-123207 - Bugzilla