# CVE-2026-63306: StoatChat SSRF in January proxy and embed endpoints

Source: https://junglewise.ai/threats/cve-2026-63306-stoatchat-ssrf-in-january-proxy-and-embed-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-63306 · Severity: high · CVSS 8.6 · Published 2026-07-16

StoatChat, a communication platform, contains a security flaw in its image and link preview components. An unauthorized attacker can use the server to send requests to internal systems that are not normally accessible from the internet. This could allow an attacker to scan private company networks, identify internal databases, or steal sensitive cloud configuration data.

## Quick answers

**Is CVE-2026-63306 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63306 being exploited in the wild.

**How severe is CVE-2026-63306?** High severity, with a CVSS score of 8.6, published 16 July 2026.

**Which products and versions are affected?** stoatchat stoatchat < 0.13.5.

**Is there a fix for CVE-2026-63306?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-63306 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-63306?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the 'january' service of StoatChat due to insufficient validation of user-supplied URLs in the /proxy and /embed endpoints. The application fails to implement DNS filtering or private IP range rejection (e.g., 10.0.0.0/8, 169.254.169.254), allowing unauthenticated attackers to proxy requests through the server. While a content-type check prevents full data exfiltration of non-media types, attackers can perform blind SSRF to enumerate internal services and ports via error-type differentials. Additionally, the /embed endpoint is susceptible to a second-hop SSRF by recursively fetching URLs found in Open Graph (OG) metadata. The vulnerability is patched in version 0.13.5.

## Affected products

- stoatchat stoatchat < 0.13.5

## Timeline

- 2026-05-17: disclosed: Advisory published by IAmTomahawkx
- 2026-07-16: advisory: NVD and VulnCheck advisories published

## References

- [https://github.com/stoatchat/stoatchat/security/advisories/GHSA-xhww-5g9p-vvq5](https://github.com/stoatchat/stoatchat/security/advisories/GHSA-xhww-5g9p-vvq5)
- [https://www.vulncheck.com/advisories/stoatchat-before-unauthenticated-ssrf-via-proxy-and-embed-endpoints](https://www.vulncheck.com/advisories/stoatchat-before-unauthenticated-ssrf-via-proxy-and-embed-endpoints)