This vulnerability involves an SSRF flaw in the UnifiedLogin service of Altium Enterprise Server versions prior to 8.1.1. An unauthenticated network attacker can cause the server to issue outbound HTTP requests to attacker-chosen destinations, including internal services that trust local requests and expose sensitive credentials without authentication. By leveraging this, the attacker can obtain stored credentials and escalate privileges to an administrative session, resulting in complete server compromise. The vulnerability does not affect Altium 365 cloud deployments because the vulnerable endpoint is disabled in that environment.

Successful exploitation allows an unauthenticated attacker to retrieve sensitive server configuration and credential material from internal services. This leads to administrative session takeover and full compromise of the Altium Enterprise Server and all its services. The vulnerability has a CVSS 4.0 base score of 10.0, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the affected endpoint is disabled in Altium 365 cloud deployments, those environments are not vulnerable. For on-premises deployments, monitor the vendor's official advisories for patches or updates addressing this SSRF vulnerability. Until a patch is available, restrict network access to the server and internal services where possible to reduce exposure.