Executive brief
aiograpi is a Python library used by developers to interact with Instagram's API. A security flaw in how the library handles account signup challenges could allow an attacker on the same local network to redirect the library's requests to a malicious server. If exploited, this could result in the theft of sensitive session headers and user credentials.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in aiograpi versions prior to 0.9.10. The library accepted server-supplied signup challenge paths and used them to construct request URLs without verifying that they were relative paths belonging to the Instagram API. An attacker capable of influencing the challenge response—such as through DNS poisoning, a compromised proxy, or local network interception—can redirect challenge-handling requests to an external host. This results in the client's session headers being sent to the attacker-controlled server during captcha or SMS challenge processing. The issue is fixed in version 0.9.10 by implementing strict path validation.
Affected products
- subzeroid aiograpi < 0.9.10
Timeline
- 2026-05-17: patched: Version 0.9.10 released
- 2026-05-17: advisory: GitHub Security Advisory published
- 2026-06-11: disclosed: NVD publication date