Autodesk · Report #3024673
SSRF in Autodesk Rendering leading to account takeover
Validstatus
criticalseverity
161upvotes
18 Mar 2025disclosed
Summary
A server side request forgery (SSRF) vulnerability was found in Autodesk Rendering, which could have allowed an attacker to send a malicious link to a victim and gain control of their account while logged in. Autodesk has fixed the vulnerability and we thank @metereorpreter for reporting this issue.
SSRF enables 1-click account takeover / exposes AWS metadata
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.