CVE-2026-123207

LOW 3.1

LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding

CVSS Score

3.1

EPSS Score

0.0%

EPSS Percentile

0th

LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed() by exploiting unpinned DNS resolution in fetchWithSafeRedirects(). Attackers controlling authoritative DNS can return public addresses during validation and internal addresses at connection time via /api/source/test, /api/proxy, /api/search or /api/detail to reach loopback services, private hosts or cloud metadata endpoints.

CWE	CWE-367
Vendor	librespark
Product	libretv
Published	Nov 5, 2026

Stay Ahead of the Next One

Get instant alerts for librespark libretv

Be the first to know when new low vulnerabilities affecting librespark libretv are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

LibreSpark / LibreTV

0 < v2.21.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/LibreSpark/LibreTV/issues/941 github.com: https://github.com/LibreSpark/LibreTV/pull/960 github.com: https://github.com/LibreSpark/LibreTV/commit/cb4219368b7f6502387a703ef2a781ba763da2b1 github.com: https://github.com/LibreSpark/LibreTV/releases/tag/v2.21.2 github.com: https://github.com/LibreSpark/LibreTV/blob/29cbeb3d37b4876f909a0354087a3531af0447f6/src/lib/ssrf.ts#L56-L85 vulncheck.com: https://www.vulncheck.com/advisories/libretv-before-2.21.2-ssrf-protection-bypass-via-dns-rebinding

Credits

George Chen Gaoshou101