CVEvulnerability
CVE-2026-102877
2.1 LOW
Official page ↗
- Status
- Deferred
- Published
- 2026-09-29
- Last modified
- 2026-09-30
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 2.1 LOW — CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 4.4 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-918
Description
Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal services or cloud metadata endpoints.
Related
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness
References
- https://github.com/getfider/fider github.com
- https://github.com/getfider/fider/blob/v0.37.0/app/pkg/validate/general.go github.com
- https://github.com/getfider/fider/blob/v0.37.0/app/services/httpclient/httpclient.go github.com
- https://github.com/getfider/fider/commit/45f5627b9fd15b912fb9092635c863fb4c91dd69 github.com
- https://github.com/getfider/fider/releases/tag/v0.38.0 github.com
- https://github.com/getfider/fider/security/advisories/GHSA-whx4-hxwq-qgjh github.com
- https://www.vulncheck.com/advisories/fider-before-0.38.0-ssrf-via-dns-rebinding-in-webhook-validation www.vulncheck.com