Omnom before version 0.9.0 contains a server‑side request forgery flaw that lets an authenticated user add a feed URL via the /add_feed route. By providing an arbitrary URL, the application makes internal requests to any host, returning reflected error messages that can be used to probe internal addresses and open ports. This weakness permits an attacker to reach internal resources, exfiltrate data, or launch further attacks against services that are otherwise inaccessible from the public network. The vulnerability is classified as CWE‑918 and can be used to enumerate internal infrastructure rather than delivering code directly.

The affected product is Omnom from the asciimoo vendor, versions 0.9.0 and earlier. The vulnerability is present in all releases up to and including 0.9.0; later versions have removed the insecure feed‑addition path or introduced validation.

The CVSS v3.1 score is 5.3, indicating a moderate severity. No EPSS score is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to be authenticated to the Omnom instance, which is typically a user account. Once authenticated, the attacker can submit a crafted feed URL to trigger the SSRF. The attack is straightforward and does not need elevated privileges beyond normal user rights, but it can be leveraged for internal reconnaissance or to reach services protected by internal firewalls.