PT-2026-145449
CVE-2026-103980
·
Published
2026-11-11
·
Updated
2026-11-11
Description by
CVSS 4.0
7.1
HighMetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
ideon versions prior to 0.9.6
Description
An authenticated user can bypass Server-Side Request Forgery (SSRF) protection in the
safeFetch function. The isPrivateIP() function in src/app/lib/ssrf.ts fails to recognize several IPv6 transition addresses that embed private IPv4 addresses, including IPv4-mapped (::ffff:), NAT64 well-known (64:ff9b::/96), NAT64 local-use (64:ff9b:1::/48), 6to4 (2002::/16), and Teredo (2001::/32) encodings. This allows an attacker to use these addresses in link URLs to access cloud metadata endpoints (169.254.169.254), localhost services, and RFC 1918 internal networks via the link preview metadata fetcher.Recommendations
Update to version 0.9.6.
Found an issue in the description? Have something to add? Feel free to write us 👾