Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck
CVE-2026-92602TDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URL
High 7.1
In plain English
A high-severity server-side request forgery in tduck-survey-form from TDuckCloud. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.4%top 65.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal addresses.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TDuckCloud | tduck-survey-form | 0 – through 5.3 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
References
- GitHub Issue #40 issue-tracking
- https://github.com/TDuckCloud/tduck-survey-form product
- https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f0d4db3c265d43/tduck-webhook/src/main/java/com/tduck/cloud/webhook/controller/WebhookConfigController.java#L43-L47 technical-description
- https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f0d4db3c265d43/tduck-webhook/src/main/java/com/tduck/cloud/webhook/service/sender/WebhookSenderService.java#L84-L100 technical-description
- VulnCheck Advisory: TDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URL third-party-advisory