CVE-2026-91199

Name of the Vulnerable Software and Affected Versions Refly versions prior to 1.1.1

Description An issue exists where the server fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can exploit this to force the backend to issue requests to loopback, private, and link-local addresses, including cloud metadata services, to read page titles and descriptions of internal resources. This occurs at the 'POST /v1/misc/scrape' endpoint.

Recommendations Update to a version newer than 1.1.0. As a temporary workaround, restrict access to the 'POST /v1/misc/scrape' endpoint.