Repository navigation
Security: MbinOrg/mbin
Security
No security policy detected
This project has not set up a SECURITY.md file yet.
Report a vulnerability-
Mbin downloads the icon/image/attachment URL of any remote ActivityPub actor or post it processes with a plain HTTP client that has no scheme restriction and no private, loopback, or link local address check, letting any federated (self signed, no special access needed) remote server force the Mbin instance to send arbitrary HTTP/HTTPS requests to its internal network or cloud metadata endpointGHSA-779p-4f7q-pg32 published
Oct 20, 2026 by blued-gearCritical -
ActivityPub signature verification accepts OpenSSL error resultsGHSA-x9g5-vwhc-pxm7 published
Nov 3, 2026 by melroy89Moderate -
Password-reset link poisoning through an untrusted Host headerGHSA-v54w-hc3m-68pq published
Nov 3, 2026 by melroy89High -
Unauthenticated SSRF through link-preview endpointsGHSA-58m5-w66j-f7cm published
Nov 3, 2026 by melroy89Moderate -
SSRF through link-preview endpoints (duplicate report)GHSA-f9cq-2j36-vqjg published
Nov 3, 2026 by melroy89Moderate
Learn more about advisories related to MbinOrg/mbin in the GitHub Advisory Database