CVE-2026-102923

MEDIUM 5.4

SparkyFitness: SSRF via unvalidated custom_url in AI service settings

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user saves a custom AI service URL and invokes an affected AI flow. The user can save a custom AI service URL and trigger an outbound request. Successful exploitation can send server-side POST requests with a controlled bearer value, probe internal services, and disclose the AI system prompt. This issue is fixed in version 1.6.0.

CWE	CWE-918
Vendor	codewithcj
Product	sparkyfitness
Published	Oct 16, 2026

Stay Ahead of the Next One

Get instant alerts for codewithcj sparkyfitness

Be the first to know when new medium vulnerabilities affecting codewithcj sparkyfitness are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

CodeWithCJ / SparkyFitness

< 1.6.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-rmxj-43xh-mcm3 github.com: https://github.com/CodeWithCJ/SparkyFitness/commit/0b43a37003a3fbedf4e38058130460fd4707fe29 github.com: https://github.com/CodeWithCJ/SparkyFitness/releases/tag/v1.6.0