CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')

TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback

Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

9router /v1 APIs has unauthenticated access via reverse proxy locality collapse

MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue

MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path

CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP

Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter

NLTK: pathsec SSRF protection can be bypassed when a proxy is configured

Apache Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation

MagicMirror: ssrf calendar .js

Astro: Unauthenticated path override in the @astrojs/vercel ISR function

PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes

swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor

NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint

Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin

@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints

Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities

Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode

Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access