CVE-2026-92602: TDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URL

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-16 · updated 2026-09-24
Weakness: CWE-918

Description

TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal addresses.

Affected products

TDuckCloud tduck-survey-form: through 5.3

References

https://github.com/TDuckCloud/tduck-survey-form
https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f0d4db3c265d43/tduck-webhook/src/main/java/com/tduck/cloud/webhook/controller/WebhookConfigController.java#L43-L47
https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f0d4db3c265d43/tduck-webhook/src/main/java/com/tduck/cloud/webhook/service/sender/WebhookSenderService.java#L84-L100
https://github.com/TDuckCloud/tduck-survey-form/issues/40
https://www.vulncheck.com/advisories/tduck-survey-form-through-5.3-server-side-request-forgery-via-unvalidated-webhook-url
https://github.com/TDuckCloud/tduck-survey-form/issues/40

Get alerted when CVE-2026-92602 or the next vulnerability affects your stack