CVE-2026-91199

MediumCVSS 5.0

Published: 14/09/2026(UTC)Updated: 23/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-local addresses including cloud metadata services to read page titles and descriptions of internal resources.

Risk Assessment

An attacker can exploit SSRF to access internal network resources, including cloud metadata, potentially leading to sensitive information disclosure or further attacks.

Recommendation

Update Refly to a version newer than 1.1.0 that includes a fix for URL validation.

Other vulnerabilities in Refly

CVE-2026-101052High
A security vulnerability has been detected in refly-ai refly up to 1.1.0 affecting some unknown processing of apps/api/src/modules/config/app.config.ts of the JWT Token Handler component. Manipulation with the input 'test' leads to hard-coded credentials.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS