🎯 New Report #3608558: Blind POST SSRF via Web Push Notification Endpoint
🔺Severity: Medium
👽 Reporter: misop00p
⭐️ Reputation: 182
🛠 State: resolved
💼 Team: phpBB
💵 Bounty: null
🕐 Submitted: 2026-03-16
⏰ Disclosed: 2026-05-30 16:47:37
📝 Summary: A vulnerability was discovered in phpBB 4.0.0-alpha1 that allowed registered users to register arbitrary URLs as their Web Push notification endpoint. The endpoint URL was stored without validation and later used by the phpBB server to send outbound HTTP POST requests, potentially leading to blind POST server-side request forgery (SSRF) vulnerabilities.
📂 Report JSON File: 3608558
@hackeronereports