CVE-2025-69206 Hemmelig has SSRF Filter bypass in Secret Request functionality
Authenticated users can bypass SSRF filters in Hemmelig to access internal network resources via DNS rebinding or open redirects.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-69206?
CVE-2025-69206 is a medium-severity server-side request forgery vulnerability in HemmeligOrg Hemmelig.app, published on 29 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Hemmelig is a messing app with with client-side encryption and self-destructing messages. Prior to version 7.3.3, a Server-Side Request Forgery (SSRF) filter bypass vulnerability exists in the webhook URL validation of the Secret Requests feature. The application attempts to block internal/private IP addresses but can be bypassed using DNS rebinding or open redirect services. This allows an authenticated user to make the server initiate HTTP requests to internal network resources. Version 7.3.3 contains a patch for the issue.
Weakness: CWE-918
Which versions are affected by CVE-2025-69206?
2 open source packages ship an affected version, including hemmelig. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
hemmelig npm | All versions | 7.3.3 |
hemmelig npm | All versions | 7.3.3 |
Products include Hemmelig Hemmelig.
How do I fix CVE-2025-69206?
Upgrade hemmelig to 7.3.3 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-69206 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-69206 exists.
Sources
Also known as GHSA-vvxf-wj5w-6gj5.