This vulnerability exists in the connect_stream_endpoint/sync_agents function of the AiraHub.py component in IhateCreatingUserNames2 AiraHub2 up to commit 3e4b77fd7d48ed811ffe5b8d222068c17c76495e. It allows an attacker to perform server-side request forgery by manipulating input parameters, causing the server to send crafted requests to unintended locations. The vulnerability can be triggered remotely without user interaction and requires low privileges. Due to the rolling release model of the product, exact affected or fixed versions are not specified. The vendor has not provided any advisory or patch information, and the remediation level is unknown. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability.

Successful exploitation of this SSRF vulnerability could allow an attacker to cause the affected server to make unauthorized requests to internal or external systems. This may lead to information disclosure or interaction with internal services not normally accessible to the attacker. The impact is rated medium severity with a CVSS 4.0 score of 5.3. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has not responded to disclosure and no official fix or mitigation is currently available. Users should monitor vendor communications for updates. Until a fix is released, consider restricting network access from the affected service to sensitive internal resources as a temporary mitigation.