Krayin CRM versions 2.2.5 through 2.2.6 contain a server‑side request forgery filter bypass that allows users with webhook permissions to reach internal addresses through DNS rebinding. The service validates a public address during WebhookService::isSafeEndpoint() but an attacker can supply a private address at a later resolution step, causing blind requests to internal services and cloud metadata endpoints.

The vulnerability affects the Krayin Laravel CRM package, specifically versions 2.2.5 and 2.2.6. Versions 2.2.7 and later include the fix and are not affected.

The CVSS score is 2.1, indicating a low risk if only direct internal network access is the concern. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user with webhook permissions and relies on DNS rebinding; the attack surface is therefore limited to users who have the ability to configure or trigger webhooks.