CVE-2026-97326 Details
Description
A weakness has been identified in songxinjianqwe Chat up to ac63d25297079eed5e4ba7e88d3b7a032637150d. Affected by this issue is some unknown functionality of the file chat-server/src/main/java/cn/sinjinsong/chat/server/ChatServer.java of the component chat-server. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.
A server-side request forgery (SSRF) vulnerability has been identified in the Chat-master project, specifically within the chat-server component, in the file ChatServer.java, up to commit ac63d25297079eed5e4ba7e88d3b7a032637150d. This vulnerability allows remote, unauthenticated attackers to send crafted TASK messages that the server processes without authentication, leading to outbound HTTP requests being made from the server's network context. The full response of these requests is then returned to the attacker, potentially exposing sensitive information from internal services or cloud metadata endpoints. Additionally, due to a lack of authentication checks, attackers can spoof sender identities when sending chat messages, impersonating other users.
To address this vulnerability, implement server-side authentication checks for all message types before processing them. Establish a mapping between socket channels and authenticated user identities to ensure that only verified users can send messages. For the SSRF vulnerability, validate URLs before fetching them, blocking requests to loopback, private, and cloud metadata IP ranges. Consider removing the file fetching functionality entirely if it's not needed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/HazyX0/cve/issues/1 | [email protected] | ExploitIssue TrackingTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-97326 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/908781 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/409334 | [email protected] | BundlePermission Required |
| https://vuldb.com/vuln/409334/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| songxinjianqwe Chat-master | 1.0-SNAPSHOT |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | New CVE Received | [email protected] |