Skip to main content

Xiaobei

1 CVEs product

Monthly

CVE-2026-85667 Sep 04, 14:32 CRITICAL Act Now

Unauthenticated message injection and server-side request forgery in TeamWiseFlow xiaobei through 5.5.2 let remote attackers reach the agent pipeline without any credentials. The webhook endpoints implement neither authentication nor signature validation (CWE-306), so an attacker can POST crafted payloads to the /webhook_worktool handler to inject arbitrary messages, and abuse the handler's unvalidated media-URL fetching to make the server issue requests to internal services. No public exploit identified at time of analysis, but the flaw is remotely reachable against default deployments and was independently reported by VulnCheck.

Authentication Bypass SSRF Xiaobei
NVD GitHub
CVSS 4.0
9.3
EPSS
0.4%
EPSS 0% CVSS 9.3
CRITICAL Act Now

Unauthenticated message injection and server-side request forgery in TeamWiseFlow xiaobei through 5.5.2 let remote attackers reach the agent pipeline without any credentials. The webhook endpoints implement neither authentication nor signature validation (CWE-306), so an attacker can POST crafted payloads to the /webhook_worktool handler to inject arbitrary messages, and abuse the handler's unvalidated media-URL fetching to make the server issue requests to internal services. No public exploit identified at time of analysis, but the flaw is remotely reachable against default deployments and was independently reported by VulnCheck.

Authentication Bypass SSRF Xiaobei
NVD GitHub

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy