Saloon builds request URLs by combining a connector’s base URL with an endpoint. When that endpoint is a valid absolute URL, the library sends the request to the absolute location, bypassing the base URL and attaching any authentication headers, cookies, or tokens. This allows an attacker to cause the server to send traffic to an arbitrary host, potentially exfiltrating credentials or accessing internal resources. The flaw is a Server‑Side Request Forgery (CWE‑918) that can also result in credential leakage (CWE‑522).

The PHP library Saloon, published by saloonphp, is impacted. All versions earlier than 4.0.0 contain the flaw. An attacker can exploit it when an endpoint value can be supplied from user input or system configuration, such as redirect_uri or callback URLs.

The CVSS score of 6.6 indicates moderate severity, while the EPSS score is below 1%, suggesting that exploitation is not common in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that the application uses Saloon and that an absolute endpoint can be influenced by the attacker. The likely attack vector is a server‑side request forgery where the attacker supplies a crafted absolute URL as the request endpoint. If successful, the server will reach the attacker‑controlled host, potentially leaking authentication tokens or exposing internal services.