CVE-2026-28508 Idno: Unauthenticated SSRF via URL Unfurl Endpoint

Critical 9.2 Published 6 Mar 2026 Updated 6 Mar 2026

Unauthenticated attackers can bypass CSRF protection to force the Idno server to make arbitrary HTTP requests, potentially accessing internal networks and cloud metadata.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-28508?

CVE-2026-28508 is a critical server-side request forgery vulnerability in idno, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Idno is a social publishing platform. Prior to version 1.6.4, a logic error in the API authentication flow causes the CSRF protection on the URL unfurl service endpoint to be trivially bypassed by any unauthenticated remote attacker. Combined with the absence of a login requirement on the endpoint itself, this allows an attacker to force the server to make arbitrary outbound HTTP requests to any host, including internal network addresses and cloud instance metadata services, and retrieve the response content. This issue has been patched in version 1.6.4.

Weakness: CWE-918

Which versions are affected by CVE-2026-28508?

2 open source packages ship an affected version, including idno/known. It affects 1 product.

Package	Affected	Fixed in
`idno/known` Packagist	All versions	`1.6.4`
`idno/known` Packagist	All versions	`1.6.4`

Products include Withknown Known.

How do I fix CVE-2026-28508?

Upgrade idno/known to 1.6.4 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-28508 being exploited?

There is no known exploitation of CVE-2026-28508 in the wild and no public exploit code.

Sources

Also known as GHSA-fcrh-fqxh-6fx6.