Submit #1025070: https://github.com/maotoumao/MusicFreeDesktop MusicFreeDesktop 0.0.8 Local Sensitive Logic Exposure leading to SSRF

Yank Note's Electron desktop application starts a request-forwarder HTTP server on 127.0.0.1:52735 (retrying up to port 52755 if occupied). The server has no authentication and exposes an API that lets any caller request an arbitrary URL with an arbitrary HTTP method and headers.

A page opened by the victim can make the victim's machine send HTTP(S) requests to arbitrary destinations, including services listening only on 127.0.0.1. The caller controls methods such as DELETE, POST, and PUT, as well as headers such as Authorization and Cookie, and can read the complete response. The server also returns Access-Control-Allow-Origin: *, so a normal cross-origin browser request can read the response without a preflight

• Source: ⚠️ https://github.com/maotoumao/MusicFreeDesktop/issues/443
• User: Anonymous User
• Submission: 10/12/2026 05:38 (17 days ago)
• Moderation: 10/28/2026 16:53 (17 days later)
• Status: Accepted
• VulDB entry: 428016 [maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8 Request Forwarder server-side request forgery]
• Points: 20