CVE-2026-19374 describes a server-side request forgery vulnerability in the adafap api-mcp up to commit 92b9a5d04acfec165c7d4ef852496593aa87be06. The flaw exists in the customAxios function of the Proxy API Endpoint component (file app/api/proxy/route.ts). By manipulating the url argument, an attacker can cause the server to perform unauthorized requests. The vulnerability is remotely exploitable without authentication. Due to the rolling release model, no fixed or affected version numbers are specified. The project has been notified but has not issued a patch or advisory.

Successful exploitation allows an unauthenticated remote attacker to induce the server to make arbitrary requests, potentially accessing internal resources or services not otherwise accessible. This can lead to information disclosure, integrity loss, or availability impact depending on the target of the SSRF. The CVSS 3.1 base score of 7.3 reflects a moderate risk with network attack vector, low attack complexity, no privileges required, and impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should monitor official channels for updates. Until a fix is available, consider implementing network-level protections to restrict outbound requests from the affected service to trusted destinations only, if feasible.