Description

Idno is a social publishing platform. Prior to version 1.6.4, a logic error in the API authentication flow causes the CSRF protection on the URL unfurl service endpoint to be trivially bypassed by any unauthenticated remote attacker. Combined with the absence of a login requirement on the endpoint itself, this allows an attacker to force the server to make arbitrary outbound HTTP requests to any host, including internal network addresses and cloud instance metadata services, and retrieve the response content. This issue has been patched in version 1.6.4.

INFO

Published Date :

2026-03-06T04:13:19.621Z

Last Modified :

2026-03-06T16:07:56.001Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-28508 vulnerability.

Vendors Products
Idno
  • Idno
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-28508.

URL Resource
https://github.com/idno/idno/releases/tag/1.6.4 cve-icon cve-icon
https://github.com/idno/idno/security/advisories/GHSA-fcrh-fqxh-6fx6 cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability