Ech0 contains a Server-Side Request Forgery (SSRF) vulnerability in the fetchPeerConnectInfo function, which uses an unsafe HTTP request method without URL validation. Authenticated users can exploit this to make the server request arbitrary URLs, including internal and cloud metadata endpoints such as AWS instance metadata and Kubernetes API endpoints. This vulnerability affects versions prior to 1.4.8-0.20260503040602-091d26d2d942 and has a high severity rating.