CVE-2026-23603

14th percentile - higher than 14% of all known CVEs

Blind SSRF vulnerability in OAuth2 avatar synchronization via unvalidated OIDC picture claim.

An attacker can exploit this to make requests to internal network resources, potentially leading to information disclosure or attacks on internal services.

Validate and sanitize the picture claim in OIDC, e.g., by checking if the URL is allowed. Restrict access to internal IP addresses.