External risk intelligence

Stoatchat Server-Side Request Forgery Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-63306

The vulnerability affects specific endpoints (/proxy and /embed) in a web application. Such endpoints are commonly exposed as part of public-facing web services or APIs to provide functionality like link previewing or resource embedding, making them reachable from the internet in standard deployment patterns.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in stoatchat, allowing unauthenticated attackers to exploit server-side request forgery to probe internal networks and sensitive information. This could potentially expose internal services or cloud credentials.

Unauthenticated attackers can probe internal networks.
Confirms exposure to internal probing and potential credential theft.
Assess relevance and potential exposure within your environment.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted requests to the `/proxy` or `/embed` endpoints of the stoatchat application. These endpoints accept arbitrary URLs without sufficient validation, allowing an attacker to redirect the server to internal network resources or external services. This can lead to the exposure of sensitive information or the enumeration of internal systems.

No authentication required to initiate attack.
Malicious URLs trigger server-side request forgery.
Internal service enumeration and data exposure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in stoatchat could allow an unauthenticated attacker to make requests from the server to arbitrary internal or external network resources. This is possible when the affected endpoints are used to proxy URLs without proper validation, enabling the attacker to probe the internal network and potentially interact with internal services or metadata endpoints.

Internal network services could be exposed.
Malicious URLs could be supplied to endpoints.
Internal services may be enumerated.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated Server-Side Request Forgery (SSRF) vulnerability impacts the `/proxy` and `/embed` endpoints, allowing attackers to probe internal services and sensitive metadata. Owners of web applications or platforms that integrate this technology should prioritize identifying all instances, assessing their exposure to the internet, and confirming business criticality before planning remediation.

Application or platform owners should own this issue.
Verify reachability and business criticality first.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Stoatchat?

Stoatchat is a software application or component used to manage chat-related features, such as rendering link previews or embedding content. It provides specific utilities, including proxy and embed functionality, which allow the application to fetch and display remote resources for users.

What is the vulnerability in CVE-2026-63306?

This CVE describes a Server-Side Request Forgery (SSRF), classified as CWE-918. It means the application can be tricked into making unintended network requests. Because the software fails to check if a requested URL points to a private internal location or a sensitive service, an attacker can use the application as a proxy to reach parts of your network that should be off-limits.

How can an attacker trigger this SSRF vulnerability?

An attacker triggers this by sending a specially crafted request to the /proxy or /embed endpoints. These endpoints accept arbitrary URLs. The bug is triggered when the application fetches these URLs without validating the destination. Simply accessing the application homepage without targeting these specific functions does not trigger the vulnerability; the attacker must explicitly provide malicious URLs or redirect chains to the vulnerable endpoints.

Why is this a concern for my infrastructure?

Halo Surface Signal notes that because /proxy and /embed endpoints are often used for public-facing features like link previews, they are likely exposed to the internet. If your instance is internet-facing, attackers can reach internal systems, fingerprint your applications, or even attempt to access instance metadata endpoints, effectively bypassing your network perimeter.

What steps should I take to respond?

First, identify all instances of Stoatchat within your environment to understand where this software is running. Next, determine if the /proxy and /embed endpoints are accessible from the internet. Prioritize these internet-facing systems for remediation by updating to version 0.13.5 or later, which addresses the validation missing in earlier versions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.