{"id":"CVE-2026-33182","aliases":["GHSA-c83f-3xp6-hfcp"],"url":"https://o3.security/vulnerability/CVE-2026-33182","summary":"Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL","details":"### Impact\nUsers providing user generated input into the `resolveEndpoint` method on requests.\n\n### Patches\nUpgrade to Saloon v4+\n\nUpgrade guide: https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4\n\n### Description\nWhen building the request URL, Saloon combined the connector's base URL with the request endpoint. If the endpoint was a valid absolute URL (e.g. https://attacker.example.com/callback), the code used that URL as-is and ignored the base URL. The request—and any authentication headers, cookies, or tokens attached by the connector—was then sent to the attacker-controlled host. If the endpoint could be influenced by user input or configuration (e.g. redirect_uri, callback URL), this allowed server-side request forgery (SSRF) and/or credential leakage to a third-party host. The fix (in the next major version) is to reject absolute URLs in the endpoint: URLHelper::join() throws InvalidArgumentException when the endpoint is a valid absolute URL, unless explicitly allowed, requiring callers to opt-in to the functionality on a per-connector or per-request basis.\n\n### Credits\nSaloon thanks @HuajiHD for finding the issue and recommending solutions and @JonPurvis for applying the fix.","published":"2026-03-26T00:22:14.472Z","modified":"2026-08-12T03:51:32.429539271Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"saloonphp/saloon","fixedVersion":"4.0.0"}],"fix":null,"references":[{"type":"WEB","url":"https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33182.json"},{"type":"ADVISORY","url":"https://github.com/saloonphp/saloon/security/advisories/GHSA-c83f-3xp6-hfcp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33182"},{"type":"PACKAGE","url":"https://github.com/saloonphp/saloon"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:32.429539271Z"}}