CVE-2026-107394

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is...

CVE-2026-107394

The event management system Indico is vulnerable to a Server-Side Request Forgery (SSRF) flaw in versions prior to 3.3.13 . The root cause is an incomplete check in the Flask-Multipass authentication system, which failed to cover an edge case identified in a previous fix for CVE-2026-25738. This ...