Vulnerability · Published Sep 29, 2026 · Assigned by VulnCheck
CVE-2026-102877Fider before 0.38.0 SSRF via DNS rebinding in webhook validation
Medium 4.4
In plain English
A medium-severity server-side request forgery in fider from getfider. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Severity (CVSS 3.1)4.4Medium
Exploit odds (30 days)0.2%top 88.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal services or cloud metadata endpoints.
Affected products (as reported)
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
References
- GitHub Security Advisory (GHSA-whx4-hxwq-qgjh) vendor-advisory
- https://github.com/getfider/fider/commit/45f5627b9fd15b912fb9092635c863fb4c91dd69 patch
- https://github.com/getfider/fider/blob/v0.37.0/app/pkg/validate/general.go technical-description
- https://github.com/getfider/fider/blob/v0.37.0/app/services/httpclient/httpclient.go technical-description
- fider v0.38.0 Release Notes release-notes
- https://github.com/getfider/fider product
- VulnCheck Advisory: Fider before 0.38.0 SSRF via DNS rebinding in webhook validation third-party-advisory