AIKIDO-2026-827842

TL;DR

wlc follows URLs returned by a Weblate API server, including pagination links and object, file, and repository URLs. Origin validation used Python's urllib.parse while the underlying HTTP transport used urllib3, so a crafted URL containing a backslash before @ was parsed differently by the two components. A malicious or compromised server could exploit this parser differential to pass the origin check while the request connected to an attacker-selected host such as loopback services, private network hosts, or cloud metadata endpoints. The fix validates request origins with urllib3's parser so origin checks match the parser that selects the actual connection target.