EUVD-2026-86449
GHSA-8f9p-xx8m-68xp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed chat-server endpoint
-
ExploitSubmit attacker-controlled URL/target
-
ExecutionServer-side fetch to internal resource
-
ImpactProbe internal services or leak limited response
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the chat-server component (the ChatServer.java service) and the ability to supply the URL/target that the server subsequently fetches; the CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N) against the running server. The practical limiting factor is not configuration but deployment scale - this is a hobbyist Java project rarely exposed on production networks, and the Low impact ratings (VC:L/VI:L/VA:L) suggest a constrained or blind SSRF that leaks limited data rather than enabling full internal pivoting. |
| Impact | The CVSS 4.0 base vector (AV:N/AC:L/PR:N/UI:N) describes a remote, low-complexity, unauthenticated SSRF, but every impact metric is only Low (VC:L/VI:L/VA:L) and there is no subsequent-system impact (SC/SI/SA:N), yielding a moderate 6.9. The E:P (Proof-of-Concept) exploit-maturity flag aligns with the input signal that public exploit code exists (a GitHub issue). This is best characterized as publicly available exploit code exists - NOT confirmed active exploitation: there is no CISA KEV listing and no EPSS score supplied, so widespread automated exploitation is unproven. The single most important tempering factor is product prevalence: songxinjianqwe/Chat is an individual developer's Java chat project on GitHub with a rolling-release model and no formal versions, not enterprise software - so despite an unauthenticated-remote vector, real-world exposure is minimal. Note the data provenance is entirely VulDB/CVE.org self-referential plus one third-party exploit issue; there is no independent vendor confirmation because the vendor did not respond. Treat the CVSS metrics as VulDB-assigned rather than vendor-validated. |
| Exploit ScenarioDerived | A remote attacker sends a crafted request to the chat-server that causes ChatServer.java to fetch an attacker-supplied URL, coercing the server into making requests to internal/adjacent hosts or metadata endpoints it can reach. A public proof-of-concept is referenced (GitHub issue HazyX0/cve#1), lowering the barrier to reproduction, though the Low impact ratings suggest limited data return or blind SSRF rather than full internal compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Server-side request forgery in the chat-server component of songxinjianqwe Chat (ChatServer.java) allows remote, unauthenticated attackers to coerce the server into issuing HTTP requests to attacker-chosen URLs. The flaw is reachable over the network with low complexity and no user interaction (CVSS:4.0 AV:N/AC:L/PR:N/UI:N), but all impact metrics are rated Low (VC:L/VI:L/VA:L) with no downstream-system impact, so practical damage is limited to constrained or blind SSRF-style information leakage and internal-network probing rather than full internal pivoting. Publicly available exploit code exists (referenced from a GitHub issue), and VulDB reports that the vendor was contacted but did not respond; the project uses a rolling release model, so no specific fixed version is documented. Affected deployments are typically hobbyist Java chat-server instances rather than internet-exposed production services.
RemediationAI
No vendor-released patch was identified at time of analysis, and the maintainer did not respond to the disclosure, so no fixed release version can be cited - teams running a self-hosted copy should track the upstream repository directly and treat any commit after ac63d25297079eed5e4ba7e88d3b7a032637150d as unverified. Until a fix lands, the most effective compensating control is to never expose the chat-server port to untrusted networks: bind it to localhost or a management VLAN and front it with an authenticated reverse proxy, accepting that this breaks direct remote client access. Where the server must reach a network, add egress filtering so the Java process cannot connect to RFC1918 ranges, loopback, link-local addresses, or cloud metadata endpoints (169.254.169.254) - this blocks the core SSRF primitive but requires maintaining an accurate allow-list of legitimate outbound destinations. Run the service under a dedicated low-privilege OS account with no cloud instance credentials attached, which limits data exposure if metadata or internal services are reached. Apply a URL allow-list at the application layer if the code is self-maintained, since validation of scheme, host and resolved IP is the only durable fix for CWE-918. Monitor outbound connections from the chat-server process for unexpected destinations as a detection measure. Cross-check the VulDB entry at https://vuldb.com/vuln/409334 and the public proof-of-concept at https://github.com/HazyX0/cve/issues/1 for updated guidance; given the publicly available exploit code, assume the SSRF is trivially reproducible in any internet-facing deployment.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-918 server-side request forgery in the Java chat-server module of songxinjianqwe Chat, specifically in chat-server/src/main/java/cn/sinjinsong/chat/server/ChatServer.java. The root cause class (CWE-918) means the application accepts a URL or network target from an untrusted request and then performs the outbound fetch itself without validating the destination against a scheme, host, or IP allow-list - allowing loopback, RFC1918, link-local (including cloud metadata endpoints such as 169.254.169.254), or arbitrary external destinations to be reached through the server's network position. The CPE string cpe:2.3:a:songxinjianqwe:chat:*:*:*:*:*:*:*:* confirms the affected product is the songxinjianqwe Chat application with no version constraint annotated, consistent with a rolling-release project where no immutable release identifiers exist. The reported CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) plus the assessed CVSS:3.1 equivalent (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) agree that this is an unauthenticated, remotely triggerable defect whose confidentiality, integrity and availability effects are each Low, with no scope change into subsequent systems. The E:P metric in the 4.0 vector denotes proof-of-concept exploit maturity, matching the public PoC reference.
Know when Chat gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote unauthenticated SSRF (AV:N/AC:L/PR:N/UI:N) with only limited/blind internal reach, so C/I/A each Low and scope unchanged, matching the Low 4.0 impact metrics.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in songxinjianqwe Chat up to ac63d25297079eed5e4ba7e88d3b7a032637150d. Affected by this issue is some unknown functionality of the file chat-server/src/main/java/cn/sinjinsong/chat/server/ChatServer.java of the component chat-server. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary cod
eGain Chat 15.0.3 allows unrestricted file upload. Rated critical severity (CVSS 9.8), this vulnerability is remotely ex
The Vibease Wireless Remote Vibrator app for Android and the Vibease Chat app for iOS use cleartext to exchange messages
Server-side request forgery (SSRF) vulnerability in Link Preview in Synology Chat before 2.0.0-1124 allows remote authen
Server-side request forgery (SSRF) vulnerability in link preview in Synology Chat before 1.1.0-0806 allows remote authen
eGain Chat 15.0.3 allows HTML Injection. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, n
Multiple cross-site scripting (XSS) vulnerabilities in Slash Command Creator in Synology Chat before 2.0.0-1124 allow re
Exploit-DB