This vulnerability exists in the adafap api-mcp component, specifically in the customAxios function within app/api/proxy/route.ts. Manipulating the URL argument passed to this function can lead to server-side request forgery, enabling an attacker to make unauthorized requests from the server. The vulnerability is remotely exploitable without authentication or user interaction. Due to the product's rolling release model, no explicit affected or fixed versions are documented. The vendor has not yet issued a response or patch for this issue.

An attacker can exploit this vulnerability remotely to perform server-side request forgery, potentially causing the server to make unintended requests to internal or external systems. This can lead to information disclosure or interaction with internal services not otherwise accessible. The CVSS score of 6.9 reflects a medium impact with low attack complexity and no privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor official channels for updates. Until a patch is available, consider implementing network-level controls to restrict outbound requests from the affected service to mitigate exploitation risk.