Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL

Vulnerability

Overview

CVE-2026-33182 affects Saloon, a PHP library for building API integrations and SDKs. Prior to version 4.0.0, when constructing a request URL, Saloon's URLHelper::join() method would use an endpoint as-is if it was a valid absolute URL, ignoring the connector's base URL entirely [1][4]. This meant that any authentication headers, cookies, or tokens attached by the connector would be sent to the attacker-controlled host specified in the endpoint.

Exploitation

Prerequisites

An attacker could exploit this vulnerability if the endpoint value could be influenced by user input or configuration, such as through a redirect_uri or callback URL parameter [1][4]. No authentication is required to trigger the bug; the attacker only needs to control the endpoint string passed to resolveEndpoint() on a request. The request would then be sent to the attacker's server, carrying any credentials or tokens that the connector normally attaches.

Impact

Successful exploitation allows server-side request forgery (SSRF) and/or credential leakage to a third-party host [1][4]. An attacker could intercept OAuth tokens, API keys, or session cookies, potentially gaining unauthorized access to the application's backend services or user data.

Mitigation

The issue is fixed in Saloon version 4.0.0, which was released as a security update [2]. The fix makes URLHelper::join() throw an InvalidArgumentException when the endpoint is a valid absolute URL, unless the caller explicitly opts in on a per-connector or per-request basis [1][4]. All users are strongly advised to upgrade to v4.0.0 or later.