CVE-2026-102877

MEDIUM 4.4

Fider before 0.38.0 SSRF via DNS rebinding in webhook validation

CVSS Score

4.4

EPSS Score

0.0%

EPSS Percentile

0th

Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal services or cloud metadata endpoints.

CWE	CWE-918
Vendor	getfider
Product	fider
Published	Sep 29, 2026

Stay Ahead of the Next One

Get instant alerts for getfider fider

Be the first to know when new medium vulnerabilities affecting getfider fider are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

getfider / fider

0 < 0.38.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/getfider/fider/security/advisories/GHSA-whx4-hxwq-qgjh github.com: https://github.com/getfider/fider/commit/45f5627b9fd15b912fb9092635c863fb4c91dd69 github.com: https://github.com/getfider/fider/blob/v0.37.0/app/pkg/validate/general.go github.com: https://github.com/getfider/fider/blob/v0.37.0/app/services/httpclient/httpclient.go github.com: https://github.com/getfider/fider/releases/tag/v0.38.0 github.com: https://github.com/getfider/fider vulncheck.com: https://www.vulncheck.com/advisories/fider-before-0.38.0-ssrf-via-dns-rebinding-in-webhook-validation

Credits

George Chen