The vulnerability is a logic flaw in Idno’s authentication flow that bypasses CSRF protection on a publicly accessible URL unfurl endpoint. Because the endpoint does not require login, any unauthenticated user can send a request to cause the server to fetch arbitrary URLs. The server then returns the retrieved content, allowing attackers to probe internal hosts, services, or cloud instance metadata. This is a classic Server Side Request Forgery flaw, classified as CWE‑918, and can lead to data exposure or internal reconnaissance.

Installations of the Idno social publishing platform running a version older than 1.6.4 are affected. The advisory indicates that any unpatched release before the 1.6.4 update is vulnerable, regardless of deployment size or environment.

The CVSS score of 9.2 signals a high severity, but the EPSS score of less than 1% indicates that exploitation is unlikely in the wild. The issue is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been observed. An attacker can trigger the SSRF simply by making an HTTP request to the unfurl endpoint without authentication; no additional conditions are required. However, because the flaw allows outbound requests to any URL reachable from the server, the potential impact is significant, especially if the server can reach sensitive internal services or cloud metadata endpoints.