CVE Explorer
CVE-2026-28508
Idno is a social publishing platform. Prior to version 1.6.4, a logic error in the API authentication flow causes the CSRF protection on the URL unfurl service endpoint to be trivially bypassed by any unauthenticated remote attacker. Combined with the absence of a login requirement on the endpoint itself, this allows an attacker to force the server to make arbitrary outbound HTTP requests to any host, including internal network addresses and cloud instance metadata services, and retrieve the res
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"idno","vendor":"idno","versions":[{"status":"affected","version":"< 1.6.4"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:3110501ad12a85f4d9a99bfd4e6677cd236bf5516704493824cbaae705020be2 · sha256:58667e3174c8a425… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.2,"baseSeverity":"CRITICAL","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE"},"metric_type":"cvssV4_0"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:3110501ad12a85f4d9a99bfd4e6677cd236bf5516704493824cbaae705020be2 · sha256:58667e3174c8a425… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-918","description":"CWE-918: Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:3110501ad12a85f4d9a99bfd4e6677cd236bf5516704493824cbaae705020be2 · sha256:58667e3174c8a425… · /containers/cna/problemTypes/0/descriptions/0
Source references
2 source assertions{"name":"https://github.com/idno/idno/releases/tag/1.6.4","tags":["x_refsource_MISC"],"url":"https://github.com/idno/idno/releases/tag/1.6.4"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:3110501ad12a85f4d9a99bfd4e6677cd236bf5516704493824cbaae705020be2 · sha256:58667e3174c8a425… · /containers/cna/references/1
{"name":"https://github.com/idno/idno/security/advisories/GHSA-fcrh-fqxh-6fx6","tags":["x_refsource_CONFIRM"],"url":"https://github.com/idno/idno/security/advisories/GHSA-fcrh-fqxh-6fx6"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:3110501ad12a85f4d9a99bfd4e6677cd236bf5516704493824cbaae705020be2 · sha256:58667e3174c8a425… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.