AIKIDO-2026-10511

TL;DR

Affected versions of this package are vulnerable to server-side request forgery (SSRF) due to improper parsing and validation of user-supplied WebFinger addresses. The affected lookup logic derives request targets from externally controlled input without sufficiently restricting host, path, or private network destinations, allowing crafted addresses to redirect outbound requests to localhost, internal services, or arbitrary endpoints. An attacker able to supply malicious lookup values can cause the application to initiate unauthorized network requests, potentially exposing internal resources or enabling blind SSRF attacks.