CVE-2026-16222: 1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery
A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file backend/crm/src/main/java/cn/cordys/crm/integration/sso/service/TokenService.java of the component Third Party Endpoint. Performing a manipulation of the argument mkAddress results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16222?
CVE-2026-16222 has a medium severity rating of 6.3.
How do I fix CVE-2026-16222?
To fix CVE-2026-16222, it is recommended to update to the latest version of 1Panel-dev CordysCRM that addresses the vulnerability.
What type of vulnerability is CVE-2026-16222?
CVE-2026-16222 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
Which component is affected by CVE-2026-16222?
CVE-2026-16222 affects the TokenService.java file in the Third Party Endpoint component of 1Panel-dev CordysCRM.
What potential impact does CVE-2026-16222 have?
CVE-2026-16222 may allow an attacker to manipulate server-side requests, potentially exposing sensitive information or compromising system integrity.