CVE-2026-105628 Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint

Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatarurl from provider user data through a server-side HTTP request without internal IP validation and follows redirects by default. An attacker can provide an avatar URL that...

CVE-2026-105628 Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint

Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatarurl from provider user data through a server-side HTTP request without internal IP validation and follows redirects by default. An attacker can provide an avatar URL that...

CVE-2026-105628

The open-source project management tool Plane is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 1.4.0 . The flaw exists in the OAuth avatar synchronization flow, where the application fetches an avatar_url from provider user data via a server-side HTTP request. Because the ...