CVE-2025-69206

Hemmelig is a messing app with with client-side encryption and self-destructing messages. Prior to version 7.3.3, a Server-Side Request Forgery (SSRF) filter bypass vulnerability exists in the webhook URL validation of the Secret Requests feature. The application attempts to block internal/private IP addresses but can be bypassed using DNS rebinding or open redirect services. This allows an authenticated user to make the server initiate HTTP requests to internal network resources. Version 7.3.3 contains a patch for the issue.

• CWE-918

• https://github.com/HemmeligOrg/Hemmelig.app/commit/6c909e571d0797ee3bbd2c72e4eb767b57378228Patch
• https://github.com/HemmeligOrg/Hemmelig.app/security/advisories/GHSA-vvxf-wj5w-6gj5Exploit, Vendor Advisory
• https://github.com/HemmeligOrg/Hemmelig.app/security/advisories/GHSA-vvxf-wj5w-6gj5Exploit, Vendor Advisory

Published

Dec 29, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-69200phpMyFAQ is an open source FAQ web application. In versions …7.5
• CVE-2025-69201Tugtainer is a self-hosted app for automating updates of doc…9.8
• CVE-2025-69202Axios Cache Interceptor is a cache interceptor for axios. Pr…6.5
• CVE-2025-69203Signal K Server is a server application that runs on a centr…8.8
• CVE-2025-69204ImageMagick is free and open-source software used for editin…7.5
• CVE-2025-69205Micro Registration Utility (µURU) is a telephone self regist…6.3
• CVE-2025-69207Khoj is a self-hostable artificial intelligence app. Prior t…7.1
• CVE-2025-69208free5GC UDR is the user data repository (UDR) for free5GC, a…5.3
• CVE-2025-69209ArduinoCore-avr contains the source code and configuration f…6.9
• CVE-2025-6921The huggingface/transformers library, versions prior to 4.53…7.5
• CVE-2025-69210FacturaScripts is open-source enterprise resource planning a…5.4
• CVE-2025-69211Nest is a framework for building scalable Node.js server-sid…7.4