SSRF URL Authority Confusion via github.com@ Prefix Targeting Internal Hosts

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects Server-Side Request Forgery (SSRF) attempts exploiting URL parser inconsistencies. Attackers use a 'github.com@' prefix within a URL parameter to trick backend fetchers into connecting to unintended, potentially internal, hosts like 'metadata.google.internal', bypassing validation logic that incorrectly parses the URL authority.