PT-2025-53754 · Hemmelig · Hemmelig

Alakinnn · Published 2025-12-29 · Updated 2025-12-29 · CVE-2025-69206

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hemmelig versions prior to 7.3.3

Description A Server-Side Request Forgery (SSRF) filter bypass exists in the webhook URL validation of the Secret Requests feature in Hemmelig, a messaging app with client-side encryption and self-destructing messages. The application attempts to block internal/private IP addresses but this can be bypassed using DNS rebinding or open redirect services. This allows an authenticated user to make the server initiate HTTP requests to internal network resources.

Recommendations Update to version 7.3.3 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-69206

GHSA-VVXF-WJ5W-6GJ5

Affected Products

Hemmelig

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69206.json · Exploit
• 🔥 https://github.com/HemmeligOrg/Hemmelig.app/security/advisories/GHSA-vvxf-wj5w-6gj5 · Exploit
• https://github.com/HemmeligOrg/Hemmelig.app/commit/6c909e571d0797ee3bbd2c72e4eb767b57378228 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-69206 · Security Note
• https://osv.dev/vulnerability/CVE-2025-69206 · Vendor Advisory
• https://t.me/CVEtracker/40841 · Telegram Post
• https://twitter.com/SystemTek_UK/status/2005733917848932502 · Twitter Post