# Unauthenticated blind SSRF in Circles signature verification bypasses Nextcloud local-address protections

Unauthenticated Circles endpoints fetch attacker-supplied keyId URLs during signature verification with local addresses allowed, enabling blind SSRF to loopback/RFC1918 services.

- Payout: hidden
- Severity: medium
- Program: Nextcloud
- Found by (vendor credit): Balvant Chavda (0x0doteth)
- Found by: 0x0doteth
- Disclosed: 2026-09-17
- CVE: CVE-2026-77164
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/3303283
- Library page: https://bugbountylibrary.com/r/h1%3A3303283
- Tags: area:web domain:web impact:internal-access kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:auth-bypass vuln:ssrf

**Target:** Circles ActivityPub signature verification (RemoteController event/incoming endpoints)
**Root cause:** Circles calls setLocalAddressAllowed(true) on the HTTP client used to fetch the attacker-controlled keyId during signature verification, bypassing Nextcloud core SSRF protections; the fetch happens before trust is established.
**Steps:**
1. Enable Circles app: `occ app:enable circles`
2. Start an internal HTTP listener on 127.0.0.1:<port> inside the container
3. POST to `/index.php/apps/circles/event/` with headers `Date`, `Host`, `Content-Length`, `Digest: SHA-256=...`, and `Signature: keyId="http://127.0.0.1:<port>/key",algorithm="rsa-sha256",headers="content-length date host digest",signature="AA=="`
4. Server GETs the keyId URL before returning 401; observe the internal listener log
**How found:** Code review of public Circles routes and signature verification flow revealed retrieveSignatory fetches keyId before trust, and ConfigService.configureRequest sets setLocalAddressAllowed(true), bypassing core protections.
**Exploitation:** Unauthenticated attacker sends a signed request with a keyId pointing at an internal URL; the server performs an outbound GET to that URL to retrieve the public key before signature verification fails, achieving blind SSRF. Redirects can chain to further internal hosts.
**Escalation:** Follow server-side redirects to reach additional internal hosts; target loopback services like Collabora CODE on 9980 or cloud metadata endpoints.
**Insight:** When an app overrides a framework's SSRF guard (e.g. allow_local_address), audit every outbound fetch reachable pre-auth; signature/key-fetch flows that run before trust establishment are prime SSRF sinks even when the endpoint ultimately returns 401.