Lossless Cut
Monthly
Server-side request forgery in LosslessCut's experimental built-in HTTP API (versions up to 3.69.0) allows an adjacent-network attacker to abuse the unauthenticated local API by exploiting missing Host and Origin header validation. The missing controls enable DNS rebinding and cross-site request forgery techniques to issue unauthorized API calls through a victim's running LosslessCut instance, yielding limited confidentiality impact. A publicly available proof-of-concept exists per the exploit reference, but no active exploitation has been confirmed - the vulnerability is not listed in CISA KEV, and exploitation is gated behind a non-default experimental CLI flag that must be explicitly enabled by the user.
Server-side request forgery in LosslessCut's experimental built-in HTTP API (versions up to 3.69.0) allows an adjacent-network attacker to abuse the unauthenticated local API by exploiting missing Host and Origin header validation. The missing controls enable DNS rebinding and cross-site request forgery techniques to issue unauthorized API calls through a victim's running LosslessCut instance, yielding limited confidentiality impact. A publicly available proof-of-concept exists per the exploit reference, but no active exploitation has been confirmed - the vulnerability is not listed in CISA KEV, and exploitation is gated behind a non-default experimental CLI flag that must be explicitly enabled by the user.