Server-Side Request Forgery Vulnerability in AliasVault Password Manager

CVE-2025-59344

What is CVE-2025-59344?

AliasVault, a privacy-first password manager, contains a server-side request forgery (SSRF) vulnerability in its favicon extraction feature. In API versions 0.23.0 and lower, the exploitable URL fetching mechanism accepts user-supplied URLs and follows redirects without sufficient internal IP protections. This allows authenticated, low-privileged users to manipulate the backend, potentially accessing arbitrary internal resources. Attackers can receive responses in Base64 format, or even utilize timing and error responses to glean information about internal services. This flaw impacts only self-hosted instances of AliasVault that allow public user registration and are accessible from the internet. Users are urged to upgrade to AliasVault release 0.23.1 or higher to mitigate this issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References