Tidewave Phoenix EUVD-2026-111085

Exploitation requires that the target application runs a vulnerable Tidewave version (0.8.0 up to but not including 0.9.2) with its HTTP endpoints reachable - in practice a developer running the app locally with Tidewave's /tidewave/connect endpoint and/or the HTML toolbar injection active (toolbar defaults to enabled). The concrete trigger is the missing Host-header validation on both the /tidewave/connect response and the rendered toolbar, which allows a DNS-rebinding web page to read the Tidewave config via a same-origin request. Limiting factors: the victim must be induced to visit an attacker-controlled page (UI:P), the attacker must set up DNS rebinding of their domain to the loopback address (reflected as AT:P), exploitation only yields low-sensitivity reconnaissance data (filesystem path names, local username, project layout), and the issue is confined to the 0.8.0-0.9.1 range. The disclosed information does not itself grant access or code execution.

All available signals point to a genuinely low-priority, low-severity issue rather than a high-CVSS-but-overrated one - the signals are consistent, not conflicting. The vendor (Erlang Ecosystem Foundation CNA) scored it CVSS 4.0 at 2.3 (Low), and the vector supports that: AV:N but AT:P (a DNS-rebinding attack prerequisite), UI:P (the victim must load an attacker-controlled page), and only VC:L with no integrity or availability impact (VI:N/VA:N) and no scope change (SC/SI/SA:N). The vuln.today decision label is 'monitor,' the weakest urgency tier, which aligns with the low score. No EPSS score was provided in the input and there is no CISA KEV listing, so there is no public-exploitation-probability or active-exploitation signal to weigh; this is not a conflict, simply absent data. No verified exploit code is present - the references are a CNA advisory, an OSV entry, VulDB, NVD, and two GitHub commits (the patch and the introducing commit), none of which is a working PoC. The impact itself is limited to disclosure of filesystem path names revealing the local OS username and project layout (CWE-497), information useful for reconnaissance but not directly for compromise. Net: a real but minor information-disclosure bug in a developer tool; patch on a normal maintenance cadence, not an emergency.

A developer is running an application locally with Tidewave (0.8.0-0.9.1) enabled during development. The developer is lured to a malicious website that rebinds its own domain to 127.0.0.1; because neither /tidewave/connect nor the injected toolbar validates the Host header, the attacker's page can issue a same-origin request (which carries no Origin header) and read the exposed configuration, learning the local username and project directory layout. No public exploit code was identified at the time of analysis, and exploitation is constrained by the DNS-rebinding setup and the need for the victim to visit the attacker's page.