CVE-2026-63306 | stoatchat before 0.13.5 contains an unauthenticated server-s… | CVSS 8.6 HIGH

Description

stoatchat before 0.13.5 contains an unauthenticated server-side request forgery vulnerability in the /proxy and /embed endpoints that accept arbitrary URLs without DNS resolution filtering or private IP range validation. Attackers can enumerate internal services, fingerprint applications, and reach instance metadata endpoints by supplying malicious URLs or leveraging redirect chains to access internal infrastructure.

Metadata

CVE ID: CVE-2026-63306
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-16 12:13 UTC
Published: 2026-07-16 12:19 UTC
Last updated: 2026-07-16 12:19 UTC
Primary CWE: CWE-918
Server-Side Request Forgery (SSRF)
Vendor / Product: stoatchat / stoatchat
Sources: cve.org · NVD

Severity & Metrics

8.6 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Affected products (1)

Vendor	Product	Platform	Versions
stoatchat	stoatchat	—	0 < 0.13.5, 0.13.5

Weakness (CWE)

CWE	Source	Description
CWE-918	cna	Server-Side Request Forgery (SSRF)

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.2	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
8.6	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References (2)

GitHub Security Advisory (GHSA-xhww-5g9p-vvq5) https://github.com/stoatchat/stoatchat/security/advisories/GHSA-xhww-5g9p-vvq5
VulnCheck Advisory: stoatchat before 0.13.5 Unauthenticated SSRF via proxy and embed endpoints https://www.vulncheck.com/advisories/stoatchat-before-unauthenticated-ssrf-via-proxy-and-embed-endpoints