The vulnerability in aiograpi versions prior to 0.9.10 is a Server-Side Request Forgery (CWE-918) caused by insufficient validation of server-supplied signup challenge paths. These paths are used to build request URLs without ensuring they remain within the intended Instagram API domain. An attacker able to manipulate the challenge response, for example via local network, DNS, or proxy compromise, could exploit this to send requests to arbitrary hosts using the client's existing session headers. The issue is fixed in version 0.9.10 by adding validation to ensure challenge paths are relative Instagram API paths before proceeding with captcha or phone/SMS challenge handling.

Successful exploitation could allow an attacker to make the client send requests to arbitrary hosts with the client's session headers, potentially exposing sensitive information or enabling further attacks within the client's network context. The vulnerability does not impact integrity or availability but has a high confidentiality impact due to possible unauthorized data exposure.

Upgrade to aiograpi version 0.9.10 or later, which includes validation of challenge paths to prevent SSRF. Since no official patch link or vendor advisory is provided, users should verify the version upgrade from the official source. Patch status is not explicitly confirmed beyond the version update; check the vendor's repository or advisory for the latest remediation guidance.