CVE-2026-92602

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-92602
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92602.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-92602
Published
2026-09-16T16:03:07Z
Modified
2026-09-18T08:13:02Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
TDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URL
Details

TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal addresses.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92602.json"
}
References

Affected packages

Git / github.com/tduckcloud/tduck-survey-form

Affected ranges

Type
GIT
Repo
https://github.com/tduckcloud/tduck-survey-form
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bb28d307842288502cc24b3962243c75a2514ed5
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "5.3"
        },
        {
            "fixed": "5.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

5.*
5.1
5.2
v0.*
v0.0.1-beta
v2.*
v2.1.0
v4.*
v4.0
v5.*
v5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92602.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "173293166566628698469349691694463802282",
                "309965314487115473788699651647303862335",
                "222327194984224816809885466612669167931",
                "252201888929208847124900085855978712453",
                "61990684433025750241897778526001877594",
                "254184078622884339895546512469428335859",
                "3527171675480164646873323801549306628",
                "172569503690016240109801863370923693241",
                "187635865057716268513368501893240993438",
                "190205501286099416203014871595269226304",
                "70786902283799029236985061663360844786",
                "60054905577146075958358305591510156204"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-92602-431779e5",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/tduckcloud/tduck-survey-form/commit/bb28d307842288502cc24b3962243c75a2514ed5",
        "target": {
            "file": "tduck-form/src/main/java/com/tduck/cloud/form/request/QueryFormResultRequest.java"
        }
    }
]
vanir_signatures_modified 
"2026-09-18T08:13:02Z"