Bugsink’s webhook validation could be bypassed because of a mismatch between Python’s urllib.parse.urlparse and the requests.post behavior. A crafted URL with backslashes and an @ character can cause the validation step to think the target is an allowlisted public host while the actual HTTP request reaches a different host. This enables an attacker to force Bugsink to issue internal or otherwise forbidden requests, proving a server‑side request forgery flaw (CWE-918).

All Bugsink self‑hosted error tracking installations prior to release 2.1.3 are vulnerable. The affected product is Bugsink, and any deployment using version 2.1.2 or earlier can be impacted.

The CVSS score of 4.3 indicates moderate severity. No EPSS data is available and the vulnerability is not listed in CISA KEV, suggesting limited publicly documented exploitation. However, the flaw can be triggered by any user who can create or modify a webhook URL for their Bugsink instance. Based on the description, it is inferred that the attack vector is internally controlled input, and the impacted area is Bugsink’s outbound HTTP client. Once exploited, the attacker can make Bugsink reach arbitrary hosts or services.