Tduck Survey Form Through 5.3 Server Side Request Forgery Via Unvalidated Webhook Url

Back www.vulncheck.com

Tduck Survey Form Through 5.3 Server Side Request Forgery Via Unvalidated Webhook Url

www.vulncheck.com • September 17, 2026

Share: View original

TDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URL

tduck-survey-form <= 5.3

tduck-survey-form <= 5.3

CWE-918 Server-Side Request Forgery (SSRF)

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-92602: TDuckCloud Survey Form Vulnerability Exposes User Data A vulnerability identified as CVE-2026-92602 affects the TDuck survey form through version 5.3, allowing authenticated attackers to exploit unvalidated webhook URLs. This Server-Side Request Forgery (SSRF) vulnerability can lead to unauthorized access to sensitive survey submissions and potential data exfiltration. The issue poses a high risk for internet-facing instances used for public questionnaires, customer feedback, and similar applications. Although the vulnerability is critical, there is currently no evidence of active exploitation, proof-of-concept code, or a public exploit. Security measures should focus on reviewing webhook configurations and applying vendor patches as soon as they are available. The vulnerability was published on September 16, 2026, and requires urgent attention from affected organizations. 2 sources 59

Extracted Entities

Attack Types (1)

Server-Side Request Forgery

CWE Weaknesses (1)

Cwe-918 - Server-Side Request Forgery (ssrf)