What’s Vulnerable › Vulnerabilities

CVE-2026-63306: stoatchat before 0.13.5 Unauthenticated SSRF via proxy and embed endpoints

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-16 · updated 2026-10-08
• Weakness: CWE-918

Description

stoatchat before 0.13.5 contains an unauthenticated server-side request forgery vulnerability in the /proxy and /embed endpoints that accept arbitrary URLs without DNS resolution filtering or private IP range validation. Attackers can enumerate internal services, fingerprint applications, and reach instance metadata endpoints by supplying malicious URLs or leveraging redirect chains to access internal infrastructure.

Affected products

• stoatchat: before 0.13.5 — fixed in 0.13.5

How to fix

Upgrade to a fixed version: stoatchat 0.13.5. Check the vendor advisory for mitigations.

References

• https://github.com/stoatchat/stoatchat/security/advisories/GHSA-xhww-5g9p-vvq5
• https://www.vulncheck.com/advisories/stoatchat-before-unauthenticated-ssrf-via-proxy-and-embed-endpoints
• https://github.com/stoatchat/stoatchat/security/advisories/GHSA-xhww-5g9p-vvq5

Get alerted when CVE-2026-63306 or the next vulnerability affects your stack