A server-side request forgery vulnerability exists in IhateCreatingUserNames2 AiraHub2 up to commit 3e4b77fd7d48ed811ffe5b8d222068c17c76495e, specifically in the connect_stream_endpoint/sync_agents function within the AiraHub.py component. This vulnerability allows remote attackers to manipulate server requests, potentially causing the server to perform unintended network requests. The product's rolling release model complicates pinpointing affected or patched versions. The vendor has not issued any advisory or patch, and the vulnerability has a CVSS 4.0 base score of 5.3 (medium severity). Exploit code has been publicly disclosed, but no active exploitation has been confirmed.

Successful exploitation of this SSRF vulnerability could allow an attacker to cause the affected server to make arbitrary requests, potentially accessing internal resources or services not otherwise exposed. The medium CVSS score reflects limited impact due to required privileges and low complexity, as well as low confidence in widespread exploitation. No known active exploitation has been reported.

No official patch or remediation guidance is currently available from the vendor, who has not responded to disclosure attempts. Since the product uses a rolling release model, users should monitor updates closely for any future fixes. Until a fix is released, consider implementing network-level controls to restrict outbound requests from the affected service to trusted destinations only.