A vulnerability in the _validate_urls function of kLOsk adloop permits an attacker to manipulate the final_url argument, enabling a server‑side request forgery (S2R). This flaw, classified as CWE‑918, allows the application to send HTTP requests to arbitrary destinations under the attacker’s control. If exploited, the server could reach internal resources, exfiltrate data, or use the target’s network for further attacks, thereby compromising confidentiality and integrity.

The issue affects kLOsk adloop versions up to and including 0.9.0. The developers released version 0.10.0 with the required patch, thereby eliminating the vulnerability. No other affected versions are specified in the advisory.

The CVSS score of 5.3 denotes a moderate severity, and the exploit is publicly available, making the risk tangible. The EPSS score of < 1% indicates a low but non‑zero exploitation probability. The attack vector requires remote submission of a crafted final_url, which the application does not validate. Because this vulnerability is not listed in CISA’s KEV catalog, it may not be widely targeted, but its availability means any deployed instance remains susceptible until patched.