AiraHub2’s sync_agents endpoint can be manipulated to force the server to send arbitrary HTTP requests to external or internal resources. The vulnerability enables an attacker to trigger requests from the server’s network context, potentially accessing sensitive services or data that the server can reach. The attack may be launched remotely and the exploit has been made public, raising the risk of abuse.

The flaw exists in all releases of IhateCreatingUserNames2 AiraHub2 up to the commit d7d48ed811ffe5b8d222068c17c76495e. Because the vendor uses a rolling‑release model, specific fixed version information is not yet available. All deployments that have not yet incorporated the vendor’s latest update are vulnerable.

The CVSS score of 5.3 indicates moderate impact, while the EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation today. The vulnerability is not listed in CISA’s KEV catalog. An attacker can craft a request to the sync_agents endpoint to provoke the server‑side request forgery; the attack can be performed remotely without authentication. The vendor’s lack of response and the public nature of the exploit elevate the urgency of remediation.