This vulnerability in CoreWorxLab CAAL (up to version 1.6.0) involves a server-side request forgery flaw in an unknown function of the src/caal/webhooks.py file, specifically affecting the test-hass Endpoint. SSRF vulnerabilities enable attackers to induce the server to send crafted requests to internal or external systems, potentially bypassing access controls. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 base score of 6.9 (medium severity). Although the exploit is publicly available, the vendor has not issued any response or patch, and no remediation level is indicated.

Successful exploitation of this SSRF vulnerability could allow an attacker to make unauthorized requests from the vulnerable server to internal or external resources. This may lead to information disclosure or interaction with internal services not otherwise accessible. However, the CVSS score and vector indicate limited impact on confidentiality, integrity, and availability, classifying it as a medium severity issue. There are no known exploits in the wild beyond the public exploit disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing network-level protections such as restricting outbound requests from the affected service, applying web application firewalls with SSRF detection rules, or disabling the vulnerable functionality if feasible until a patch is released.