AIKIDO-2026-966807

stripe is vulnerable to Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) Pre-CVE Published 3 days ago

Medium Risk

This Affects:

stripe

13.0.0 - 19.6.0

Fixed in 19.6.1

Are you affected? Scan for Free

TL;DR

The API requestor builds an absolute request URL by concatenating a base address with a caller-supplied path, and no base address ends in a slash. When that path comes from untrusted input and does not begin with a single /, values such as @evil.example/v1/leak or .evil.example/v1/leak change the request authority and redirect the authenticated call, including the Stripe API key, to a non-Stripe host. Event notification and list-pagination code paths feed values taken from response and webhook bodies straight into request paths, and an event id is interpolated into a path without escaping. The fix validates that every request path is origin-relative by rejecting schemes, authorities, and userinfo, and escapes the event id before it is used.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application passes untrusted input into a request path or processes event notification or list objects whose url or id fields can be influenced by an untrusted source.