What happened
Before 0.9.4, ideon's SSRF protection for OAuth and MCP URLs relied on regex/string matching of the hostname and did not normalize IPv4-mapped IPv6 addresses, so an attacker-supplied URL/redirect referencing loopback or private IPv4 through an IPv4-mapped IPv6 form bypassed the block and reached internal services.
Why it matters
The MCP URL-validation path is the SSRF boundary for AI agent tool connectivity; a bypass lets an agent-driven request reach internal network services or cloud metadata.
Attack vector
The SSRF host-blocking in validateUrlForSSRF()/safeFetch() and validateMcpUrl() blocks hosts by string/regex matching on new URL(url).hostname; its IPv6 branch fails to normalize IPv4-mapped IPv6 forms, so a crafted target or redirect evades the blocklist.
Affected systems
3xpyth0n/ideon < 0.9.4 (validateUrlForSSRF / validateMcpUrl)
Mitigation
Upgrade to ideon 0.9.4 (normalizes IPv6 and IPv4-mapped IPv6 addresses). Restrict OAuth/MCP provider URLs to an allowlist.