CVE-2026-68507
ideon: Unauthenticated /api/links/preview endpoint is an open SSRF relay, and its IP blocklist misses the 0.0.0.0/:: unspecified-address bypass
ideon is a self-hosted visual workspace. Prior to version 0.9.5, ideon's link-preview endpoint requires no authentication at all and forwards any URL a caller supplies straight into a server-side fetch. The app does have a general-purpose SSRF guard (safeFetch/validateSafeUrl in src/app/lib/ssrf.ts), but this route sits behind no login check whatsoever, making it a fully open, anonymous URL-fetch relay - and the guard's IP blocklist itself has a gap that lets it reach the server's own loopback interface via the 0.0.0.0 "any address" bypass, a well-documented SSRF-filter evasion technique on Linux. This issue has been patched in version 0.9.5.
| CWE | CWE-306 CWE-918 |
| Vendor | 3xpyth0n |
| Product | ideon |
| Published | Nov 11, 2026 |
Get instant alerts for 3xpyth0n ideon
Be the first to know when new unknown vulnerabilities affecting 3xpyth0n ideon are published — delivered to Slack, Telegram or Discord.