Server-Side Request Forgery Vulnerability in Postiz AI Social Media Tool

CVE-2026-40168

What is CVE-2026-40168?

The Postiz AI social media scheduling tool has a vulnerability located in the /api/public/stream endpoint, which is susceptible to Server-Side Request Forgery (SSRF) in versions prior to 2.21.5. Although initial URL validation prevents direct access to private or internal hosts, it fails to re-validate the final destination after HTTP redirects. Consequently, an attacker could exploit this flaw by providing a public HTTPS URL that is initially validated, allowing redirection of server-side requests to internal resources that should otherwise remain protected.

References