HiEventsDev Hi.Events 1.7.1-beta/1.11.0 NoInternalUrlRule NoInternalUrlRule.php gethostbyname redirect

Summaryinfo

A vulnerability has been found in HiEventsDev Hi.Events and classified as problematic. The impacted element is the function gethostbyname of the file backend/app/Validators/Rules/NoInternalUrlRule.php of the component NoInternalUrlRule. The manipulation leads to redirect. This vulnerability is referenced as CVE-2026-76838. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in HiEventsDev Hi.Events. It has been rated as problematic. This issue affects the function gethostbyname of the file backend/app/Validators/Rules/NoInternalUrlRule.php of the component NoInternalUrlRule. The manipulation with an unknown input leads to a redirect vulnerability. Using CWE to declare the problem leads to CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. Impacted is integrity. The summary by CVE is:

Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backend/app/Validators/Rules/NoInternalUrlRule.php resolves the hostname with gethostbyname() and rejects private and reserved ranges, which any public hostname passes. At dispatch, WebhookDispatchService takes the stored URL and calls it through spatie/laravel-webhook-server without repeating the check, and backend/config/webhook-server.php sets no Guzzle options, so redirect following remains enabled by default. A destination that answers with a redirect to a loopback, private or cloud metadata address therefore causes the server to issue that request, and changing the hostname's DNS record after registration reaches the same result because no resolution is repeated. The response is not discarded: WebhookResponseHandlerService stores the body on the webhook log and WebhookLogResource returns it from the webhook logs endpoint, so the requester reads what the internal service replied rather than inferring it. Both event and organizer webhooks share the rule and the dispatch path. Version 1.11.1-beta revalidates at dispatch, pins the validated address, checks every redirect hop, and decodes IPv6 transition addresses that previously bypassed the filter.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-76838 since 08/19/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1204.001 according to MITRE ATT&CK.

By approaching the search of inurl:backend/app/Validators/Rules/NoInternalUrlRule.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.11.1-beta eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-65010). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• HiEventsDev

Name

• Hi.Events

Version

• 1.7.1-beta
• 1.11.0

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion