CVE-2026-16222 is a server-side request forgery vulnerability in 1Panel-dev CordysCRM affecting versions up to 1.4.1. It involves manipulation of the mkAddress argument in the backend/crm/src/main/java/cn/cordys/crm/integration/sso/service/TokenService.java file, which allows an attacker to induce the server to make unauthorized requests. The vulnerability can be triggered remotely. The issue report was closed by the project without an official fix or acknowledgment. No known exploits are reported in the wild.

The vulnerability allows an attacker to perform server-side request forgery, potentially causing the server to make unauthorized requests to internal or external systems. This could lead to information disclosure or interaction with internal services not intended to be accessible externally. However, the severity is rated low and no known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project closed the issue report without providing an official fix, users should monitor for any future updates or advisories from the vendor. Until a fix is available, consider restricting access to the vulnerable component or implementing network-level controls to limit outbound requests from the server.