The Appium Java Client from versions 8.2.1 through 10.1.1 rebuilds the client’s server URL when directConnect(true) is enabled using values supplied by the server’s NEW_SESSION response. The client only confirms that the protocol is https and performs no host or IP validation, which constitutes an insecure HTTP redirect (CWE‑441) and a server‑side request forgery (CWE‑918) flaw. A rogue or compromised server can therefore redirect all subsequent session traffic to an arbitrary destination, giving the attacker full interception of session data and a server‑side request forgery route to internal hosts, including cloud instance metadata services that expose credential information.

The vulnerability affects the Appium Java Client library from version 8.2.1 up to, but not including, 10.1.1. Users of these versions that enable directConnect(true) are exposed when communicating with a malicious or compromised Appium server or test environment.

The CVSS score is 8.2, indicating high severity, while the EPSS score is <1%, suggesting a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a trusting relationship between the client and a malicious Appium server that can supply a manipulated redirect. Attackers could harvest internal metadata credentials and pivot to internal hosts through server‑side request forgery if the server is compromised or maliciously configured.