---
id: "CVE-2026-121431"
kind: "vulnerability"
aliases: ["CVE-2026-121431"]
title: "AzuraCast: station users can reach internal services through webhook connectors"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["azuracast", "package", "self-hosted", "web-radio"]
not_affected_if: ["no-webhook-permission-users", "version-0.24.0-or-later"]
published_at: "2026-11-03T15:17:34+00:00"
first_seen_at: "2026-11-03T15:21:59+00:00"
updated_at: "2026-11-03T15:23:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121431", "first_seen_at": "2026-11-03T15:21:59+00:00"}]
---

# AzuraCast: station users can reach internal services through webhook connectors

AzuraCast before 0.24.0 lets station users with WebHooks permission bypass its URL filter through the Mastodon, Telegram, GroupMe and RadioReg connectors. An attacker can point these settings at loopback, private-network or cloud-metadata addresses and read what those services return.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the AzuraCast version in the installed release; affected versions are those before `0.24.0`.
- Look for station users who hold the WebHooks permission, since only they can reach the flaw.

## Fix

- Upgrade AzuraCast to `0.24.0` or later.

## Timeline

- 2026-11-03T15:21:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121431

## Documents

- [advisory] Vendor advisory: github.com https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-qh22-76gf-qwc4
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/azuracast-before-0.24.0-ssrf-filter-bypass-via-webhook-connectors

## From the sources

AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass the UserUrlFilter guard via the Mastodon, Telegram, GroupMe, and RadioReg connectors. Attackers can set instance_url, api, or webhookurl to internal addresses and trigger the webhook test endpoint to reach loopback, private-network, or cloud-metadata services.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_