CVE-2026-80350

OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPv6 range. The webhook delivery path calls SSRFProtection.validateWebhookTargetIsSafe, and the host-literal screening inside...

CVE-2026-80350

OneUptime before version 12.0.7 contains a Server-Side Request Forgery (SSRF) vulnerability in its webhook delivery path. The host-literal screening in Common/Server/Utils/SSRFProtection.ts (function isBlockedHostnameLiteral) rejects private and loopback IPv4 addresses and a limited set of IPv6 f...