NL Portal Backend Libraries contain a GraphQL resolver that, when called with getFormDefinitionByObjectenApiUrl or getFormDefinitionById, does not enforce authentication and forwards a caller‑supplied URL to a service that attaches a privileged Objecten‑API token. The host‑equality check limits requests to the configured Objecten‑API host but does not constrain scheme, port, or path, allowing an unauthenticated attacker to trigger a server‑side request that sends the privileged token to any chosen endpoint on that host. This flaw can expose the token, which enables downstream access to protected resources, effectively turning the SSRF into a covert token‑exfiltration channel. Based on the description, it is inferred that the attack vector is an unauthenticated GraphQL request that performs SSRF to a controlled destination on the same host.

Vendors are NL Portal Backend Libraries in product nl-portal-backend-libraries. Versions from 1.1.0 through 3.0.4, as well as 3.1.0, are affected. The 3.0 release line was fixed in version 3.0.4, but no fixed release is currently identified for the 3.1 line.

The CVSS score of 5.3 indicates a medium severity, and the EPSS score of < 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The requirement for attacker‑controlled routing on the configured host and the restriction to token‑bearing requests limits the impact compared to a full SSRF that spans hosts. Nevertheless, the ability to exfiltrate a privileged token remains a significant risk for internal services that rely on that token for authenticated operations.