Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a Server-Side Request Forgery (SSRF) within the aiograpi library, specifically in the SignUpMixin class. Several methods responsible for handling signup challenges (challenge_api, challenge_captcha, challenge_submit_phone_number, and challenge_verify_sms_captcha) were constructing request URLs using paths provided by the Instagram API response. These paths were not validated before being used. This allowed a malicious server or a Man-in-the-Middle (MITM) attacker to supply a full URL (e.g., http://attacker.com) or a protocol-relative URL (e.g., //attacker.com). The client would then make a request to this malicious domain, potentially leaking sensitive session headers. The patch, identified in commit dcf461aadd7e3a13bc8b33fc9ba7d288463adfae, introduces a new validation method _safe_challenge_api_path that ensures the provided path is a relative API path and not an absolute or scheme-relative URL. The vulnerable functions were updated to use this validation before making any requests, thus mitigating the SSRF risk.
SignUpMixin.challenge_apiaiograpi/mixins/signup.py
SignUpMixin.challenge_captchaaiograpi/mixins/signup.py
SignUpMixin.challenge_submit_phone_numberaiograpi/mixins/signup.py
SignUpMixin.challenge_verify_sms_captchaaiograpi/mixins/signup.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| aiograpi | pip | < 0.9.10 | 0.9.10 |