The vulnerability allows an attacker to send a POST request to the /tradecraft/verify endpoint without authentication. The endpoint’s URL validation checks only the initial hostname and accepts redirects or DNS rebinding, permitting the server to fetch content from internal addresses. The returned data appears in the model‑generated summary, effectively exposing internal services or metadata to the attacker.

The flaw exists in RedAmon versions up to and including 7.0.1 released by samugit83. Any deployment of RedAmon 7.0.1 or earlier is vulnerable.

With a CVSS score of 6.9, the problem is considered moderate severity. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is through publicly reachable web traffic; authentication is not required. An attacker can manually pose a URL that redirects to an internal IP or uses DNS rebinding to reach services such as cloud metadata endpoints, thus discovering information or potentially extracting sensitive data.