CVE-2026-76838: Server-Side Request Forgery (SSRF) in HiEventsDev Hi.Events

Hi.Events validates webhook destination URLs only at registration using a hostname resolution that rejects private and reserved IP ranges. However, at dispatch, the stored URL is used without revalidation, and the HTTP client follows redirects by default. An attacker can exploit this by causing the server to follow redirects to internal or cloud metadata addresses, resulting in SSRF. The response from these internal services is stored and returned to the webhook logs endpoint, allowing an attacker to read internal responses. The vulnerability affects version 1.11.1-beta, which includes fixes such as revalidating URLs at dispatch, pinning validated addresses, checking every redirect hop, and decoding IPv6 transition addresses to prevent bypasses.

An attacker can exploit this SSRF vulnerability to make the server issue requests to internal or cloud metadata services by leveraging redirects or DNS record changes after webhook registration. This can lead to unauthorized access to internal resources and sensitive data exposure through the webhook logs endpoint, which returns the internal service responses to the requester. The vulnerability has a high severity with a CVSS 4.0 score of 8.4, indicating significant risk if exploited.

No official patch or remediation level is explicitly stated in the provided data. However, version 1.11.1-beta includes fixes that revalidate webhook URLs at dispatch, pin validated addresses, check every redirect hop, and decode IPv6 transition addresses to prevent bypasses. Users should upgrade to this fixed version or later if available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.