CVE-2026-94621

Deferred Deferred - Pending Action

DNS Rebinding in AliasVault Server API Favicon Extractor

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the AliasVault server API favicon extractor validates a user-supplied hostname with a first DNS lookup but allows the HTTP client to perform a second DNS lookup when connecting. An authenticated low-privileged user operating an attacker-controlled authoritative DNS server can return a public address during validation and a private address during connection, causing a publicly reachable self-hosted server to issue HTTP or HTTPS requests to internal hosts. A valid image response is returned in Base64 form, while other responses can expose limited timing and error information for internal-network reconnaissance. Exploitation requires a publicly reachable self-hosted instance with public registration enabled, an authenticated AliasVault account, an attacker-controlled authoritative DNS server, and a resolver that permits rebinding; default checks limit requests to ports 80 and 443. The browser extensions, web application, and mobile applications are not affected. This issue is fixed in version 0.30.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-94621

EUVD

EUVD-2026-102306

Affected Vendors & Products

Vendor	Product	Version / Range
aliasvault	aliasvault	< 0.30.3
aliasvault	ghcr.io/aliasvault/aliasvault	< 0.30.3
aliasvault	ghcr.io/aliasvault/api	< 0.30.3
aliasvault	ghcr.io/lanedirt/aliasvault-api	< 0.30.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is a server-side request forgery (SSRF) vulnerability via DNS rebinding in AliasVault's favicon extraction feature. It occurs due to a time-of-check/time-of-use gap where the server validates a user-supplied hostname with one DNS lookup but the HTTP client performs a second lookup during connection. An attacker controlling a DNS server can return a public IP during validation and a private IP during connection, tricking the server into making HTTP(S) requests to internal hosts.

Detection Guidance

To detect this SSRF vulnerability via DNS rebinding in AliasVault, monitor network traffic for unexpected outbound HTTP(S) requests from the server to internal IP ranges. Check DNS logs for repeated lookups of the same hostname resolving to both public and private IPs. Use tools like tcpdump or Wireshark to capture traffic from the AliasVault server (ports 80/443) and inspect for connections to RFC1918 private addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).

Commands to check for vulnerable versions: grep -r '0.30.2' /path/to/aliasvault/ or check the version via the API endpoint. If running a self-hosted instance, verify if public registration is enabled and if the server is exposed to the internet.

Impact Analysis

An authenticated low-privileged user could exploit this to force the server to send requests to internal network hosts. If the target serves a valid image, the attacker may retrieve it in Base64 form. Otherwise, limited timing and error details could be exposed for internal-network reconnaissance. Exploitation requires a publicly reachable self-hosted instance with public registration enabled, an attacker-controlled DNS server, and a permissive DNS resolver.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized internal network reconnaissance and data exfiltration. The SSRF flaw allows attackers to force the server to make HTTP(S) requests to internal hosts, which may expose sensitive data or internal system details. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information; unauthorized access or exposure could violate these regulations.

Mitigation Strategies

Update AliasVault to version 0.30.3 or later to patch the SSRF vulnerability. Disable public registration on self-hosted instances if enabled. Ensure DNS resolvers enforce minimum TTL to prevent rebinding attacks.

Hi! I’m here to help you understand CVE-2026-94621. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70