High severity · published Sep 16, 2026
CVE-2026-92602
TDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URL
7.1
CVSS
0.4%
EPSS
No
On KEV
Description
TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal addresses.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TD
tduck-survey-form · TDuckCloud
through 5.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-92602
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-92602
github.com
https://github.com/TDuckCloud/tduck-survey-form
github.com
https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f0d4db3c265d43/tduck-webhook/src/main/java/com/tduck/cloud/webhook/controller/WebhookConfigController.java#L43-L47
github.com
https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f0d4db3c265d43/tduck-webhook/src/main/java/com/tduck/cloud/webhook/service/sender/WebhookSenderService.java#L84-L100
github.com
https://github.com/TDuckCloud/tduck-survey-form/issues/40
www.vulncheck.com
https://www.vulncheck.com/advisories/tduck-survey-form-through-5.3-server-side-request-forgery-via-unvalidated-webhook-url
More from tduck-survey-form
7.1
CVE-2026-109164
TDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey}
6.5
CVE-2026-92567
TDuck survey form through 5.0 Unauthorized Data Modification
5.4
CVE-2026-100303
TDuck survey form through 6.0 Missing Authorization in Form Theme Management Endpoints
5.3
CVE-2026-100306
TDuck survey form through 6.0 Write Password Bypass via Client-Side Enforcement
5.3
CVE-2026-100304
TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check