CVE-2026-102877: Fider before 0.38.0 SSRF via DNS rebinding in webhook validation
Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal services or cloud metadata endpoints.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires administrator-level privileges in Fider and control over DNS for a hostname used in a webhook or custom OAuth provider endpoint. The attacker can use DNS rebinding to change the validated destination before Fider sends its request.
Which configurations are exposed?
Fider deployments that allow administrators to configure webhooks or custom OAuth provider endpoints are exposed before version 0.38.0. The vulnerable validation has a time-of-check time-of-use gap for those outbound URLs.
What can an attacker reach through the vulnerable server?
A successful attack can cause the Fider server to send requests to internal services or cloud metadata endpoints. The reported impact includes limited confidentiality and integrity impact, with no availability impact stated.