CVE-2026-105628

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0

Description The OAuth avatar synchronization flow performs a server-side HTTP request to fetch the avatar url from provider user data without validating internal IP addresses and follows redirects by default. This allows an attacker to provide a URL that redirects to an internal-only resource, such as a metadata endpoint. The system then uploads the response as a user avatar file, which is exposed through the '/api/assets/v2/static/{asset id}/' endpoint, enabling the exfiltration of internal content.

Recommendations Update to version 1.4.0.