Hi.Events CVE-2026-76838

Exploitation requires a valid Hi.Events platform account with permission to register webhooks - the CVSS PR:L metric confirms a low-privilege authenticated session is sufficient; unauthenticated access is not possible. The attacker must additionally control a domain that can be configured to serve an HTTP redirect to an internal or reserved IP address (covering the redirect-based path), or a domain whose DNS record can be changed after webhook registration before the next dispatch (covering the DNS rebinding path). The Hi.Events server must have outbound HTTP access to the targeted internal resource; cloud-hosted instances with accessible IMDS endpoints represent the highest-risk deployment. No non-default platform configuration is required - webhook functionality is a standard feature. Exploitation is bounded by: the authentication requirement limiting anonymous mass exploitation, and the need for attacker control over a DNS record or a redirect-serving endpoint.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N correctly captures the threat profile: the attack is network-reachable, requires no special conditions beyond a low-privilege account, and produces high confidentiality impact on both the vulnerable system and subsequent systems such as cloud metadata services. The subsequent-system confidentiality impact (SC:H) reflects the ability to reach AWS IMDS (169.254.169.254), GCP metadata (metadata.google.internal), or internal APIs and return their responses verbatim to the attacker - an impact level consistent with IAM credential theft in cloud-hosted deployments. EPSS data was not supplied, so exploitation probability cannot be quantified against the broader threat landscape. The CVE is not in CISA KEV and no public exploit code has been identified, but the attack technique (redirect-based SSRF and DNS rebinding) is thoroughly documented in public SSRF literature and the entire codebase is open source, meaning the vulnerable path is trivially auditable. The PR:L authentication requirement is the primary limiting factor: an attacker must hold a valid platform account with webhook-registration permission. For any deployment running on a cloud provider with an accessible IMDS endpoint - the common case for SaaS-style Hi.Events installs - this should be treated as a high-priority patch.

An authenticated Hi.Events organizer registers a webhook pointing to a domain they control (e.g., attacker.example.com), which resolves to a legitimate public IP at registration time, passing the NoInternalUrlRule check. Before the next event trigger fires the webhook, the attacker reconfigures attacker.example.com to respond with an HTTP 301 redirect to http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name. When the webhook dispatches, the server follows the redirect, retrieves the cloud IAM credentials from the metadata service, and stores the response body in the webhook log; the attacker then reads the credentials directly from the webhook logs API endpoint. No public exploit code has been identified at time of analysis, but the attack technique requires no specialized tooling.