This vulnerability exists in the adafap api-mcp project up to commit 92b9a5d04acfec165c7d4ef852496593aa87be06, specifically in the customAxios function within app/api/proxy/route.ts. Manipulation of the URL argument in this function can lead to server-side request forgery, enabling an attacker to cause the server to send crafted requests to internal or external resources. The vulnerability can be exploited remotely without authentication or user interaction. Due to the rolling release model, exact affected versions are not specified. The vendor has not yet provided a patch or official remediation guidance.

Successful exploitation allows an unauthenticated remote attacker to induce the server to make arbitrary HTTP requests, potentially accessing internal resources or services not otherwise exposed. This can lead to information disclosure or further attacks depending on the internal network environment. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.9, reflecting its network attack vector and low complexity but limited impact scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor the project's official channels for updates. Until a fix is available, consider implementing network-level controls to restrict outbound requests from the affected service to trusted destinations only, if feasible.