CVE-2026-63306

Name of the Vulnerable Software and Affected Versions stoatchat versions prior to 0.13.5

Description An unauthenticated server-side request forgery (SSRF) issue exists where the server fails to implement DNS resolution filtering or private IP range validation. This allows attackers to enumerate internal services, fingerprint applications, and access instance metadata endpoints by providing malicious URLs or using redirect chains to reach internal infrastructure via the '/proxy' and '/embed' endpoints.

Recommendations Update to version 0.13.5 or later. Restrict access to the '/proxy' and '/embed' endpoints to minimize the risk of exploitation.