CVE-2026-63306CWE-918ssrf

CVE-2026-63306

High · published July 16, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
22.1
In the wild
Unconfirmed
What it is

stoatchat before 0.13.5 contains an unauthenticated server-side request forgery vulnerability in the /proxy and /embed endpoints that accept arbitrary URLs without DNS resolution filtering or private IP range validation. Attackers can enumerate internal services, fingerprint applications, and reach instance metadata endpoints by supplying malicious URLs or leveraging redirect chains to access internal infrastructure.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00305 · 22.1th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-07-16T17:16Z
References (3)
https://github.com/stoatchat/stoatchat/security/advisories/GHSA-xhww-5g9p-vvq5 · [email protected]https://www.vulncheck.com/advisories/stoatchat-before-unauthenticated-ssrf-via-proxy-and-embed-endpoints · [email protected]https://github.com/stoatchat/stoatchat/security/advisories/GHSA-xhww-5g9p-vvq5 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 16 JUL 12:19Z
    stoatchat before 0.13.5 Unauthenticated SSRF via proxy and embed endpoints
    cvelistv5