Executive brief
Douyin_TikTok_Download_API is a self-hosted tool for downloading TikTok and Douyin videos without watermarks. The application contains an unauthenticated server-side request forgery (SSRF) vulnerability in its API endpoints that allows attackers to make arbitrary HTTP requests to internal services and cloud metadata endpoints, potentially exposing sensitive credentials through error messages.
Technical details
The vulnerability is a server-side request forgery (SSRF) flaw in the /api/download and /api/hybrid/video_data endpoints. The application fails to properly validate the url query parameter, allowing unauthenticated attackers to specify arbitrary URLs for the server to fetch. This enables attackers to request internal services (including cloud metadata endpoints like AWS EC2 IMDSv1) and retrieve sensitive information such as credentials from error responses. No authentication is required; the attack is network-accessible and requires only the ability to craft a malicious request with a url parameter pointing to the target URL.
Affected products
- Evil0ctal Douyin_TikTok_Download_API through 4.1.2
Timeline
- 2026-09-04: disclosed