MusicFreeDesktop CVE-2026-118577

The affected component is the app's local Request Forwarder - a proxy worker that, in versions 0.0.6/0.0.7/0.0.8, accepted any request to its port with no access-token validation. Exploitation requires getting the application to emit or process a crafted proxy request (CVSS UI:P indicates passive user interaction, e.g. a user loading/playing attacker-influenced content), after which the forwarder relays to an attacker-chosen destination. Limiting factors: user interaction is required; impact is limited to SSRF with low confidentiality/integrity/availability effect; and after the patch every proxy URL must carry the per-launch 32-byte random token, which closes the unauthenticated-relay path. The product is a small-footprint open-source player, further limiting real-world exposure.

This is a moderate-severity SSRF (CWE-918) in the Request Forwarder of MusicFreeDesktop, a niche open-source Electron music player. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L, score 5.3) shows network reach, low complexity, and no required privileges, but it hinges on passive user interaction (UI:P) and yields only low impact across confidentiality, integrity, and availability. The source-code patch confirms the mechanism: before the fix the forwarder worker accepted any request to its port with no access token, so proxy URLs could be abused to make the app forward requests to arbitrary destinations; the fix adds a per-launch random 32-byte token that every proxy request must carry. Exploitation signals are mixed and point to low urgency: no CISA KEV listing, no EPSS score provided, and the referenced PoC is a GitHub issue (not verified working exploit code). The vuln.today Decision label is 'this_month' (not act_now/emergency), consistent with a real but non-critical issue rather than a high-CVSS-but-low-real-risk false alarm - the true limiter is the product's very small deployment footprint, not the technical severity. No EPSS data is available, so widespread-exploitation probability cannot be independently assessed.

An attacker lures a user of the MusicFreeDesktop app into playing or loading attacker-influenced content that causes the app to issue a request through the unauthenticated local Request Forwarder. Because the forwarder (pre-patch) relays requests without any access-token check, the attacker steers it to fetch an internal or otherwise restricted URL, receiving the limited response back. A public PoC reference exists (GitHub issue #443); it is not verified as working exploit code.