refly-ai vulnerabilities

Products

• refly 2

Latest refly-ai CVEs

Newest publication first

1. CVE-2026-101052 refly-ai refly JWT Token app.config.ts hard-coded credentials

   Published 2026-09-28

   Medium·CVSS 6.9 EPSS 0.28%

   A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the input test leads to hard-coded credentials. It...

2. CVE-2026-91199 Refly through 1.1.0 Server-Side Request Forgery via scrape endpoint

   Published 2026-09-14

   Medium·CVSS 5.3 EPSS 0.34%

   Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, priva...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.