CVE-2026-123207

    Dashboard / Vulnerabilities / CVE-2026-123207

    CVE-2026-123207

    Published: 5 Nov 2026Last Modified: 7 Nov 2026

    Summary: LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding

    Details: LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed() by exploiting unpinned DNS resolution in fetchWithSafeRedirects(). Attackers controlling authoritative DNS can return public addresses during validation and internal addresses at connection time via /api/source/test, /api/proxy, /api/search or /api/detail to reach loopback services, private hosts or cloud metadata endpoints.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123207.json, https://github.com/LibreSpark/LibreTV/releases/tag/v2.21.2, https://nvd.nist.gov/vuln/detail/CVE-2026-123207, https://www.vulncheck.com/advisories/libretv-before-2.21.2-ssrf-protection-bypass-via-dns-rebinding, https://github.com/LibreSpark/LibreTV/issues/941, https://github.com/LibreSpark/LibreTV/commit/cb4219368b7f6502387a703ef2a781ba763da2b1, https://github.com/LibreSpark/LibreTV/pull/960, https://github.com/LibreSpark/LibreTV, https://github.com/LibreSpark/LibreTV/blob/29cbeb3d37b4876f909a0354087a3531af0447f6/src/lib/ssrf.ts#L56-L85

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -722e86fce102aa6701e73a83dd0a14eb5ba707c9

    Affected versions

    v2.21.1
    v2.21.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-123207 | CVE-DB