The vulnerability in fedify arises because the getNodeInfo() function follows attacker-controlled URLs from the /.well-known/nodeinfo endpoint without validating the scheme, redirects, or whether the target is a private or loopback address. This lack of validation allows an attacker to induce the server to make HTTP requests to internal or cloud metadata services and return their response bodies, potentially leaking sensitive information. The flaw affects multiple maintenance lines from version 1.2.0 up to but not including patched versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2. The CVSS 4.0 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality.

Successful exploitation allows an unauthenticated attacker to make the vulnerable server perform HTTP requests to internal or cloud metadata services, potentially exposing sensitive internal data or configuration information. This can lead to information disclosure within the internal network or cloud environment. There is no indication of privilege escalation or code execution from the provided data.

A fix is available and has been released in fedify versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2. Users should upgrade to these or later versions to remediate the vulnerability. No other mitigation guidance is provided in the vendor advisory; therefore, upgrading is the recommended action.