The scalar/astro v0.1.13 Scalar Proxy endpoint accepts a scalar_url query parameter that is used to fetch a remote resource. This parameter is not authenticated or validated, allowing any attacker‑controlled URL to be fetched. The backend server may send its own authentication cookies or headers when requesting the target URL, exposing sensitive credentials that can be used to impersonate legitimate users or gain elevated privileges.

Scalar/astro v0.1.13 contains an exposed Scalar Proxy endpoint that accepts the scalar_url parameter. No vendor product list is provided in the CNA data, so the exact vendor or product name is unknown beyond scalar/astro. The SSRF flaw applies only to the Proxy endpoint in that specific version.

The CVSS score is not publicly available, and there is no EPSS value. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is an unauthenticated HTTP request to the vulnerable endpoint with a crafted scalar_url parameter. Because the parameter accepts arbitrary URLs, an attacker can target internal or external hosts and force the server to transmit authentication cookies and headers that may belong to privileged accounts. The exploit can be performed quickly, requiring only the ability to issue an HTTP request to the exposed endpoint; no additional privileges on the backend are necessary to realize the SSRF effect.