Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-102923— SparkyFitness: SSRF via unvalidated custom_url in AI service settings

Quick assessment

Affected
CodeWithCJ SparkyFitness
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SparkyFitness 是一款面向家庭、支持自部署且由人工智能驱动的健康与健身追踪工具。在 1.6.0 版本之前， 和 未对自定义 AI 服务设置中提供的目标地址进行验证。已认证用户可保存自定义 AI 服务 URL 并触发受影响的 AI 流程，从而发起出站请求。成功利用此漏洞后，攻击者可发送携带可控 Bearer 令牌的服务器端 POST 请求、探测内部服务，并泄露 AI 系统提示词（system prompt）。该问题已在 1.6.0 版本中修复。

CVSS 5.4 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
CodeWithCJ SparkyFitness < 1.6.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-102923

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SparkyFitness: SSRF via unvalidated custom_url in AI service settings
Source: CVE Program / CVE List V5
Vulnerability Description
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user saves a custom AI service URL and invokes an affected AI flow. The user can save a custom AI service URL and trigger an outbound request. Successful exploitation can send server-side POST requests with a controlled bearer value, probe internal services, and disclose the AI system prompt. This issue is fixed in version 1.6.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
CodeWithCJ SparkyFitness < 1.6.0 -

II. Public POCs for CVE-2026-102923

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-102923

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-102923 (1)

IV. Related Vulnerabilities

Same product: SparkyFitness
Same vendor: CodeWithCJ
Same weakness: CWE-918

V. Comments for CVE-2026-102923

No comments yet

Leave a comment