Live › vulnerability › CVE-2026-121431
AzuraCast before 0.24.0 lets station users with WebHooks permission bypass its URL filter through the Mastodon, Telegram, GroupMe and RadioReg connectors. An attacker can point these settings at loopback, private-network or cloud-metadata addresses and read what those services return.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Only AzuraCast instances older than 0.24.0 where station users hold the WebHooks permission and can use the Mastodon, Telegram, GroupMe or RadioReg connectors. Instances where only trusted administrators have webhook access are lower risk, but the sources do not say whether the flaw is reachable from outside the network.
No product ranges from the sources yet.
0.24.0.0.24.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass the UserUrlFilter guard via the Mastodon, Telegram, GroupMe, and RadioReg connectors. Attackers can set instance_url, api, or webhookurl to internal addresses and trigger the webhook test endpoint to reach loopback, private-network, or cloud-metadata services.
This page as .md · .json · in your agent: get_signal("CVE-2026-121431")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.