alam00000 BentoPDF up to 2.8.6 DNS-over-HTTPS Safety Check cors-proxy-worker.js hostnameResolvesToPrivate cross-domain policy

Summaryinfo

A vulnerability was found in alam00000 BentoPDF up to 2.8.6. It has been rated as problematic. This affects the function hostnameResolvesToPrivate of the file cloudflare/cors-proxy-worker.js of the component DNS-over-HTTPS Safety Check. The manipulation leads to cross-domain policy. This vulnerability is traded as CVE-2026-102354. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in alam00000 BentoPDF up to 2.8.6. This issue affects the function hostnameResolvesToPrivate of the file cloudflare/cors-proxy-worker.js of the component DNS-over-HTTPS Safety Check. The manipulation with an unknown input leads to a cross-domain policy vulnerability. Using CWE to declare the problem leads to CWE-942. The product uses a cross-domain policy file that includes domains that should not be trusted. Impacted is confidentiality. The summary by CVE is:

BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In versions through 2.8.6, cloudflare/cors-proxy-worker.js performs a DNS-over-HTTPS safety check in hostnameResolvesToPrivate(), as used by isValidCertificateUrl() and isValidTsaUrl(), separately from the outbound fetch(targetUrl, ...). In deployments where PROXY_SECRET validation is not enabled, a direct client that controls authoritative DNS can forge the Origin header, supply a certificate, OCSP, CRL, or TSA URL that passes the proxy's accepted path checks, return a public address during validation, and return a private or link-local address during the later fetch. The endpoint can return allowed response bodies to the attacker, but exploitation requires precise timing, redirects and IP-literal obfuscation are blocked, and network reachability limits the target. This vulnerability is fixed in 2.8.7.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-102354 since 09/29/2026. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 2.8.7 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• alam00000

Name

• BentoPDF

Version

• 2.8.0
• 2.8.1
• 2.8.2
• 2.8.3
• 2.8.4
• 2.8.5
• 2.8.6

Website

• Product: https://github.com/alam00000/bentopdf/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion