Executive brief
A vulnerability in the Scalar Astro documentation proxy allows attackers to steal sensitive user information. By tricking a user into clicking a link or visiting a page with a hidden image, an attacker can force the Scalar server to forward the user's authentication cookies and headers to an external server. In many corporate environments, this can lead to full account takeover and unauthorized access to internal applications.
Technical details
A Server-Side Request Forgery (SSRF) exists in the 'scalar_url' query parameter of the Scalar Proxy endpoint in scalar/astro v0.1.13. The application fails to validate the destination URL and, critically, forwards the inbound 'Cookie' header verbatim to the remote destination. An unauthenticated attacker can craft a URL pointing to a malicious listener; when a victim visits this URL, the proxy server fetches the attacker's URL and includes the victim's domain-scoped cookies in the outbound request. This is particularly severe in self-hosted deployments where cookies are scoped to a parent domain, enabling zero-click session hijacking and account takeover. No patch was reported at the time of disclosure.
Affected products
- Scalar scalar/astro 0.1.13
Timeline
- 2025-10-25: other: Vendor notified via support email; no response received.
- 2026-03-27: other: CVE-2026-30118 assigned by MITRE.
- 2026-05-18: disclosed: Public disclosure after 90-day window expired.
- 2026-05-19: advisory: NVD publication date.