CVE Explorer
CVE-2026-47157
aiograpi is an asynchronous Instagram API for Python. aiograpi versions before 0.9.10 accepted server-supplied signup challenge paths and used them to build request URLs before validating that the paths were relative Instagram API paths. If an attacker can influence a challenge response, for example through a local network, DNS, or proxy compromise, challenge handling requests could be sent outside the intended Instagram host with the client's existing session headers. Version 0.9.10 validates c
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"aiograpi","vendor":"subzeroid","versions":[{"status":"affected","version":"< 0.9.10"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:b0dcaa732a9354deea7cd25a30e6303c66eb51dec2fc690194706783a20fc04a · sha256:363c09177e87a315… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:b0dcaa732a9354deea7cd25a30e6303c66eb51dec2fc690194706783a20fc04a · sha256:363c09177e87a315… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-918","description":"CWE-918: Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:b0dcaa732a9354deea7cd25a30e6303c66eb51dec2fc690194706783a20fc04a · sha256:363c09177e87a315… · /containers/cna/problemTypes/0/descriptions/0
Source references
4 source assertions{"name":"https://github.com/subzeroid/aiograpi/commit/9c24151916beca622e588bfb3167c98711ff744f","tags":["x_refsource_MISC"],"url":"https://github.com/subzeroid/aiograpi/commit/9c24151916beca622e588bfb3167c98711ff744f"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:b0dcaa732a9354deea7cd25a30e6303c66eb51dec2fc690194706783a20fc04a · sha256:363c09177e87a315… · /containers/cna/references/2
{"name":"https://github.com/subzeroid/aiograpi/pull/274","tags":["x_refsource_MISC"],"url":"https://github.com/subzeroid/aiograpi/pull/274"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:b0dcaa732a9354deea7cd25a30e6303c66eb51dec2fc690194706783a20fc04a · sha256:363c09177e87a315… · /containers/cna/references/1
{"name":"https://github.com/subzeroid/aiograpi/releases/tag/0.9.10","tags":["x_refsource_MISC"],"url":"https://github.com/subzeroid/aiograpi/releases/tag/0.9.10"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:b0dcaa732a9354deea7cd25a30e6303c66eb51dec2fc690194706783a20fc04a · sha256:363c09177e87a315… · /containers/cna/references/3
{"name":"https://github.com/subzeroid/aiograpi/security/advisories/GHSA-jh37-x3fv-4x72","tags":["x_refsource_CONFIRM"],"url":"https://github.com/subzeroid/aiograpi/security/advisories/GHSA-jh37-x3fv-4x72"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:b0dcaa732a9354deea7cd25a30e6303c66eb51dec2fc690194706783a20fc04a · sha256:363c09177e87a315… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.