The does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attack