SSRF vulnerability happens when a web application is fetching a remote resource without validating the user-supplied URL. This can allow an attacker to coerce the application to send a crafted request to an unexpected destination, even when protected by a firewall, VPN, or another type of network access control list (ACL).