This vulnerability in bigsk1 openai-realtime-ui involves server-side request forgery via manipulation of a query argument in the API Proxy Endpoint's server.js file. The flaw allows remote attackers to cause the server to make unintended requests. The affected version is identified by a specific commit hash, and a patch commit is available, though no detailed vendor advisory or official remediation status is provided. The CVSS 4.0 score rates this as a medium severity issue with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation of this SSRF vulnerability could allow an attacker to make the vulnerable server perform unauthorized requests to internal or external systems, potentially leading to information disclosure or further network reconnaissance. The medium CVSS score reflects limited impact due to low privileges required but with some impact on confidentiality, integrity, and availability. No known active exploits have been reported at this time.

A patch identified by commit 54f8f50f43af97c334a881af7b021e84b5b8310f is suggested to remediate this vulnerability. Since the product uses continuous delivery with rolling releases, users should update to the latest version containing this patch. Patch status is not explicitly confirmed by a vendor advisory; therefore, users should verify the application of this patch in their environment. No additional vendor guidance is available.