CVE-2026-19374

Name of the Vulnerable Software and Affected Versions adafap api-mcp versions up to 92b9a5d04acfec165c7d4ef852496593aa87be06

Description A server-side request forgery issue exists in the Proxy API Endpoint component within the file app/api/proxy/route.ts. The flaw occurs in the customAxios() function, where improper handling of the url argument allows a remote attacker to induce the server to make unauthorized requests.

Recommendations As a temporary workaround, restrict access to the customAxios() function in the app/api/proxy/route.ts file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.