aiograpi versions before 0.9.10 do not validate the paths provided by server‑supplied signup challenges. An attacker who can influence the challenge response—through a compromised local network, DNS spoofing, or proxy manipulation—can craft a path that points to an arbitrary host. The library then builds a request URL with this unvalidated path and sends it with the victim’s session headers, allowing the attacker to send arbitrary requests to any destination the client can reach.

The issue affects the aiograpi Python library distributed by subzeroid. All releases prior to 0.9.10 are vulnerable. Version 0.9.10 and later incorporate input validation that prevents the construction of URLs from untrusted challenge paths.

The CVSS score of 6.5 indicates moderate severity. Although EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, the flaw requires the attacker to control a challenge response, which is feasible via local network or DNS compromise. Once that prerequisite is met, the attacker can perform SSRF attacks that may exfiltrate session data or reach internal services.