CVE-2026-94621AliasVault: Server-Side Request Forgery via DNS rebinding in Favicon Extraction
Updated under an hour ago ()
Does this affect you?
It affects aliasvault and 3 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the AliasVault server API favicon extractor validates a user-supplied hostname with a first DNS lookup but allows the HTTP client to perform a second DNS lookup when connecting. An authenticated low-privileged user operating an attacker-controlled authoritative DNS server can return a public address during validation and a private address during connection, causing a publicly reachable self-hosted server to issue HTTP or HTTPS requests to internal hosts. A valid image response is returned in Base64 form, while other responses can expose limited timing and error information for internal-network reconnaissance. Exploitation requires a publicly reachable self-hosted instance with public registration enabled, an authenticated AliasVault account, an attacker-controlled authoritative DNS server, and a resolver that permits rebinding; default checks limit requests to ports 80 and 443. The browser extensions, web application, and mobile applications are not affected. This issue is fixed in version 0.30.3.
- CVSS
- 6.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
- Weakness (CWE)
- CWE-367, CWE-918
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Deferred
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
aliasvault aliasvault aliasvault:aliasvault (from the name) | before 0.30.3 | CNA record |
aliasvault ghcr.io/aliasvault/aliasvault aliasvault:ghcr.io_aliasvault_aliasvault (from the name) | before 0.30.3 | CNA record |
aliasvault ghcr.io/aliasvault/api aliasvault:ghcr.io_aliasvault_api (from the name) | before 0.30.3 | CNA record |
aliasvault ghcr.io/lanedirt/aliasvault-api aliasvault:ghcr.io_lanedirt_aliasvault_api (from the name) | before 0.30.3 | CNA record |
References
- https://github.com/aliasvault/aliasvault/security/advisories/GHSA-7hm6-fj4m-pf6fx-refsource-confirm
- https://github.com/aliasvault/aliasvault/pull/2311x-refsource-misc
- https://github.com/aliasvault/aliasvault/commit/7eb4fee71f4582cfc80b8daea421b99d6aa9f814x-refsource-misc
- https://github.com/aliasvault/aliasvault/commit/90ea7d6bb4c74ca169ee1dde3ca38b08bd0966edx-refsource-misc
- https://github.com/aliasvault/aliasvault/releases/tag/0.30.3x-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.