Vendor
The xiaobei product through version 5.5.2 lacks authentication on webhook endpoints, enabling unauthenticated remote code execution via pipeline message injection and server-side request forgery (SSRF) via malicious media URL fetching.