Douyin_TikTok_Download_API through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /api/hybrid/video_data endpoints that allows unauthenticated attackers to fetch arbitrary URLs by supplying a url query parameter. Attackers can request internal services including cloud metadata endpoints and retrieve response bodies containing sensitive credentials through error messages.

CVE-2026-85608 affects Douyin_TikTok_Download_API through version 4.1.2, exposing a server-side request forgery (SSRF) vulnerability in two endpoints: /api/download and /api/hybrid/video_data. Unauthenticated attackers can exploit this flaw by supplying an arbitrary URL via the 'url' query parameter, causing the server to fetch the specified resource on their behalf. This allows attackers to reach internal services, including cloud metadata endpoints such as AWS IMDSv1, which can expose sensitive credentials and configuration data. Sensitive information can be leaked through error messages returned in the response body. No authentication is required to exploit this vulnerability, significantly increasing its risk surface. The affected code is identified in the crawlers/douyin/web/utils.py file in the repository. The vulnerability is documented in the project's GitHub issue tracker and in a VulnCheck advisory. Organizations using this API in cloud-hosted or internally networked environments are particularly at risk.