Origin validation error in titra - #VU126573
Published: April 20, 2026
Vulnerability identifier: #VU126573
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-346
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass domain whitelist restrictions and trigger unauthorized webhook processing.
The vulnerability exists due to origin validation error in the webhook verification endpoint in server/APIroutes.js when handling requests with user-controlled Host or X-Forwarded-Host headers. A remote attacker can send a specially crafted request with a malicious header value to bypass domain whitelist restrictions and trigger unauthorized webhook processing.
Only deployments that use the webhook verification feature are affected in practice, and the impact may include SSRF-like behavior if internal domains are present in the whitelist.
Affected software
titra
Remediation
Install security update from vendor's website.
titra - update to 1.0.0