Server-Side Request Forgery in API Proxy Endpoint

A security vulnerability has been detected in adafap api-mcp up to 92b9a5d04acfec165c7d4ef852496593aa87be06. This affects the function customAxios of the file app/api/proxy/route.ts of the component Proxy API Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The adafap api-mcp Proxy API Endpoint contains a server-side request forgery (SSRF) vulnerability in the customAxios function that fails to properly validate the url argument. This vulnerability allows attackers to manipulate API requests to access internal resources, interact with backend systems, or exfiltrate sensitive data by crafting malicious URLs. With a CVSS score of 7.3, this represents a high-severity risk affecting any deployment using vulnerable versions of the api-mcp component. Organizations running this platform should prioritize patching, as the rolling release strategy means affected instances may not have clear version identifiers for tracking exposure.

Casky's 331 matched skills leverage Claude AI with extended reasoning to detect the attack patterns underlying this SSRF vulnerability by analyzing techniques from MITRE ATT&CK's Initial Access (TA0001) and Execution (TA0006) tactics. Practitioners using Casky would identify suspicious findings such as unexpected outbound connections from the proxy endpoint to internal IP ranges, unusual hostname resolution patterns, or HTTP requests to localhost and private subnets—classic SSRF signatures. The platform's skill mapping enables detection of reconnaissance activity where attackers probe the proxy's capabilities, followed by exploitation attempts targeting cloud metadata endpoints, internal APIs, or database services. By correlating these behavioral patterns against 754 security skills, Casky helps teams distinguish legitimate proxy traffic from adversary-controlled requests attempting to forge server-side actions.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-19374.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-19374

Casky has 331 skills that investigate the attack patterns behind CVE-2026-19374. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn