An unauthenticated attacker can manipulate a remote domain used by Lemmy to resolve to the IP address 0.0.0.0. The v4_is_invalid() function in activitypub‑federation‑rust does not reject this unspecified address, bypassing previous SSRF protections. As a result, the server may issue HTTP requests to localhost services, exposing internal interfaces or metadata. This server‑side request forgery can lead to data disclosure, credential theft, or further lateral movement within the host.

Systems running LemmyNet's Lemmy platform with the activitypub‑federation‑rust component prior to version 0.7.0‑beta.9 are affected. The vulnerability resides specifically in the authentication‑ignoring v4_is_invalid() routine. Instances of the older Lemmy build that expose user‑controlled federation URLs to the library are at risk.

CVSS score of 6.5 indicates a moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require control of a remote domain name resolved by the victim server. Once the SSRF bypass succeeds, the attacker can reach any localhost services, including administration interfaces and internal APIs, thereby expanding the attack surface. Administrators should consider this a low‑to‑moderate risk but treat it as urgent, given the ease of creating a malicious domain.