This vulnerability involves a server-side request forgery (SSRF) in anubissbe ProjectHub-Mcp versions up to 5.0.0. The flaw is located in an unspecified function in the backend-fix/complete_backend.js file of the Webhooks API component. By manipulating the URL argument, an attacker can cause the server to make unintended requests. The vulnerability allows remote exploitation. There is no vendor response or patch available at this time.

An attacker can exploit this SSRF vulnerability remotely to cause the affected server to make arbitrary requests. This can potentially lead to unauthorized internal network access or interaction with internal services. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, and no user interaction needed, with low to limited confidentiality, integrity, and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. Until a fix is available, consider restricting or validating URLs accepted by the Webhooks API to mitigate SSRF risk.