An unauthenticated attacker can coerce the server into issuing HTTP requests to an attacker-chosen host by spoofing the "X Forwarded-Host" (and "X-Forwarded-Proto") request headers. The forwarded host is used, without validation, to build the URL that "server_info_update()" fetches with cURL, resulting in a Server-Side Request Forgery (SSRF) that requires no authentication.