Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-94621— AliasVault: Server-Side Request Forgery via DNS rebinding in Favicon Extraction

Quick assessment

Affected
aliasvault aliasvault
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

AliasVault 是一款以隐私为优先级的密码管理器，内置电子邮件别名功能。在版本 0.30.3 之前，AliasVault 服务器 API 中的网站图标（favicon）提取器在对用户提供的hostname进行验证时，仅执行一次 DNS 查询，但在建立 HTTP 连接时却允许 HTTP 客户端进行第二次 DNS 查询。拥有认证权限的低权限用户，若操控一个权威 DNS 服务器，可以在验证阶段返回一个公共 IP 地址，而在实际连接阶段返回一个私有 IP 地址。这种 DNS 重绑定攻击可导致面向公网的自建服务器向内网

CVSS 6.3 · Medium

Affected Version Matrix 4

VendorProduct Version RangeStatus
aliasvault aliasvault < 0.30.3 affected
aliasvault ghcr.io/aliasvault/aliasvault < 0.30.3 affected
aliasvault ghcr.io/aliasvault/api < 0.30.3 affected
aliasvault ghcr.io/lanedirt/aliasvault-api < 0.30.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-94621

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
AliasVault: Server-Side Request Forgery via DNS rebinding in Favicon Extraction
Source: CVE Program / CVE List V5
Vulnerability Description
AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the AliasVault server API favicon extractor validates a user-supplied hostname with a first DNS lookup but allows the HTTP client to perform a second DNS lookup when connecting. An authenticated low-privileged user operating an attacker-controlled authoritative DNS server can return a public address during validation and a private address during connection, causing a publicly reachable self-hosted server to issue HTTP or HTTPS requests to internal hosts. A valid image response is returned in Base64 form, while other responses can expose limited timing and error information for internal-network reconnaissance. Exploitation requires a publicly reachable self-hosted instance with public registration enabled, an authenticated AliasVault account, an attacker-controlled authoritative DNS server, and a resolver that permits rebinding; default checks limit requests to ports 80 and 443. The browser extensions, web application, and mobile applications are not affected. This issue is fixed in version 0.30.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
检查时间与使用时间(TOCTOU)的竞争条件
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
aliasvault aliasvault < 0.30.3 -
aliasvault ghcr.io/aliasvault/aliasvault < 0.30.3 -
aliasvault ghcr.io/aliasvault/api < 0.30.3 -
aliasvault ghcr.io/lanedirt/aliasvault-api < 0.30.3 -

II. Public POCs for CVE-2026-94621

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-94621

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-94621 (3)

Vendor Advisories for CVE-2026-94621 (1)

Other References for CVE-2026-94621 (1)

IV. Related Vulnerabilities

Same product: aliasvault
Same vendor: aliasvault
Same weakness: CWE-367

V. Comments for CVE-2026-94621

No comments yet

Leave a comment