AIKIDO-2026-10365

TL;DR

Affected versions of this package are affected by a server-side request forgery (SSRF) vulnerability due to insufficient validation of certain fields received from the configured identity provider. Because these fields may be processed without proper restrictions, a malicious actor controlling or compromising data at the identity provider could cause the application to perform unintended requests to internal or external resources, potentially leading to information disclosure. Exploitation requires the attacker to have the ability to supply manipulated data through the identity provider and depends on specific field mappings being configured.