Firefly III's webhook URL validator improperly handles loopback IP addresses and DNS resolution, allowing authenticated users with webhooks enabled to configure webhooks targeting internal loopback services. The validator permits addresses in the 127.0.0.0/8 range due to an early return and performs hostname resolution only once at validation, while the actual webhook request re-resolves the hostname, enabling DNS rebinding attacks. The vulnerability results in a blind server-side request forgery (SSRF) without direct response feedback to the user.