The vulnerability is a server‑side request forgery that allows an unauthenticated attacker to cause Vaultwarden to fetch a favicon from an IP‑literal URL supplied in attacker‑controlled HTML. The second‑stage favicon download bypasses URL normalization and the custom DNS resolver, allowing the server to resolve internal or loopback addresses. Successful exploitation can reveal internal services through the returned image, timing, status, or cache behavior. The defect is identified as CWE‑918.

Vaultwarden servers running any version prior to 1.37.0 with internal icon downloading enabled are affected. The product is provided by dani‑garcia’s Vaultwarden.

The CVSS score of 5.8 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote, unauthenticated, and relies on the icon download feature; an attacker only needs to host a public page containing a malicious favicon URL. The impact is potential exposure of internal addresses and services, but no arbitrary code execution or privilege escalation beyond the server’s environment.