TDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URL

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-92602 · Microsoft / collected KEV context

cve-program · CVE-2026-92602

• https://github.com/TDuckCloud/tduck-survey-form/issues/40
• https://github.com/TDuckCloud/tduck-survey-form
• https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f0d4db3c265d43/tduck-webhook/src/main/java/com/tduck/cloud/webhook/controller/WebhookConfigController.java#L43-L47
• https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f0d4db3c265d43/tduck-webhook/src/main/java/com/tduck/cloud/webhook/service/sender/WebhookSenderService.java#L84-L100
• https://www.vulncheck.com/advisories/tduck-survey-form-through-5.3-server-side-request-forgery-via-unvalidated-webhook-url

No related operational record is retained in the current change model.