CVE-2026-124442 · Package
NO FIX YET · SEE WHAT TO DO
AzuraCast before 0.24.0 lets users with station WebHooks permission bypass its URL filter by using HTTP redirects in webhook targets. An attacker can make the server request internal services and read the responses in test logs.
first public Oct 24, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted AzuraCast instances older than 0.24.0 where users hold the station WebHooks permission. The flaw is reached through Mastodon, Telegram, GroupMe, or RadioReg webhook configuration pointing at a redirecting URL. Instances where only trusted administrators can edit webhooks have a smaller exposure.
Not affected if azuracast-0.24.0-or-later, no-webhook-permission-users
Who cares azuracast, radio, self-hosted
0.24.0 or later is not affected by this CVE0.24.0 or laterAzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows users with station WebHooks permission to bypass the UserUrlFilter SSRF guard through HTTP redirects. Attackers can configure Mastodon, Telegram, GroupMe, or RadioReg webhooks pointing to a redirecting URL, causing the Guzzle client to reach internal services and expose responses via test logs.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.