The vulnerability allows a server‑side request forgery by exploiting a time‑of‑check, time‑of‑use gap in the validation of webhook URLs. Administrators who can manipulate DNS for the domain that resolves to the Fider instance can force the application to send HTTP requests to any target hostname, including internal services or cloud metadata endpoints. The flaw can expose sensitive internal data or enable further exploitation, but the current CVSS score indicates the impact is low.

All releases of the Fider application prior to version 0.38.0 are affected. The product is identified as Fider, developed by getfider. Versions older than v0.38.0 must be considered vulnerable and excluded from production environments unless mitigated.

The reported CVSS score of 2.1 classifies the risk as low, and the EPSS score is not available, suggesting no known exploitation activity yet. The flaw appears to be exploitable remotely through DNS rebinding when the application accepts webhook URLs supplied by an administrator. The vulnerability is not listed in the CISA KEV catalog, indicating no documented widespread exploitation at this time. However, the combination of DNS control and outbound request capability means a malicious actor could obtain internal network information or access cloud instance metadata if the Fider server runs on a cloud platform.