{"id":"CVE-2026-124442","kind":"vulnerability","aliases":["CVE-2026-124442"],"related":[],"title":"AzuraCast: station webhook users can reach internal services via redirects","description":"AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows users with station WebHooks permission to bypass the UserUrlFilter SSRF guard through HTTP redirects. Attackers can configure Mastodon, Telegram, GroupMe, or RadioReg webhooks pointing to a redirecting URL, causing the Guzzle client to reach internal services and expose responses via test logs.","summary":"AzuraCast before 0.24.0 lets users with station WebHooks permission bypass its URL filter by using HTTP redirects in webhook targets. An attacker can make the server request internal services and read the responses in test logs.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["azuracast","package","radio","self-hosted"],"not_affected_if":["azuracast-0.24.0-or-later","no-webhook-permission-users"],"how_to_check":"- Check the AzuraCast version in the installation; `0.24.0` or later is not affected by this CVE\n- Review which users hold the station WebHooks permission","fix":"- AzuraCast: move to `0.24.0` or later","status":"open","published_at":"2026-11-08T14:18:10+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","triaged_at":"2026-11-08T14:49:51+00:00","updated_at":"2026-11-08T14:49:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T14:49:51Z","model":"claude-haiku-5-5","output":{"fix":"- AzuraCast: move to `0.24.0` or later","reach":"network","title":"AzuraCast: station webhook users can reach internal services via redirects","impact":"medium","summary":"AzuraCast before 0.24.0 lets users with station WebHooks permission bypass its URL filter by using HTTP redirects in webhook targets. An attacker can make the server request internal services and read the responses in test logs.","audience":"businesses","category":"package","nicknames":[],"who_cares":["azuracast","self-hosted","radio"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"internal services reachable from server, responses readable in logs","analyst_note":"","how_to_check":"- Check the AzuraCast version in the installation; `0.24.0` or later is not affected by this CVE\n- Review which users hold the station WebHooks permission","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["azuracast-0.24.0-or-later","no-webhook-permission-users"],"who_is_affected":"Self-hosted AzuraCast instances older than 0.24.0 where users hold the station WebHooks permission. The flaw is reached through Mastodon, Telegram, GroupMe, or RadioReg webhook configuration pointing at a redirecting URL. Instances where only trusted administrators can edit webhooks have a smaller exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000721,"input_tokens":4636,"output_tokens":514,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124442':13A,16A '-2026':12A,15A '0.24.0':25B,61C 'allow':71C 'attack':44B,86C 'azuracast':1A,17B,23B,59C 'bypass':32B,78C 'caus':100C 'client':103C 'configur':88C 'contain':62C 'cve':11A,14A 'expos':109C 'filter':35B 'forgeri':68C 'groupm':91C 'guard':82C 'guzzl':102C 'host':22B 'http':38B,84C 'intern':7A,50B,106C 'let':26B 'log':58B,113C 'make':46B 'mastodon':89C 'packag':18B 'permiss':31B,76C 'point':95C 'radio':19B 'radioreg':93C 'reach':6A,105C 'read':53B 'redirect':10A,39B,85C,98C 'request':49B,67C 'respons':55B,110C 'self':21B 'self-host':20B 'server':48B,65C 'server-sid':64C 'servic':8A,51B,107C 'side':66C 'ssrf':81C 'station':2A,29B,74C 'target':42B 'telegram':90C 'test':57B,112C 'url':34B,99C 'use':37B 'user':4A,27B,72C 'userurlfilt':80C 'via':9A,111C 'vulner':69C 'webhook':3A,30B,41B,75C,94C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted AzuraCast instances older than 0.24.0 where users hold the station WebHooks permission. The flaw is reached through Mastodon, Telegram, GroupMe, or RadioReg webhook configuration pointing at a redirecting URL. Instances where only trusted administrators can edit webhooks have a smaller exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["azuracast","high","package","radio","selfhosted"],"campaign_type":null,"search_a":"'-124442':13A,16A '-2026':12A,15A 'azuracast':1A 'cve':11A,14A 'intern':7A 'reach':6A 'redirect':10A 'servic':8A 'station':2A 'user':4A 'via':9A 'webhook':3A","search_b":"'0.24.0':25B 'attack':44B 'azuracast':17B,23B 'bypass':32B 'filter':35B 'host':22B 'http':38B 'intern':50B 'let':26B 'log':58B 'make':46B 'packag':18B 'permiss':31B 'radio':19B 'read':53B 'redirect':39B 'request':49B 'respons':55B 'self':21B 'self-host':20B 'server':48B 'servic':51B 'station':29B 'target':42B 'test':57B 'url':34B 'use':37B 'user':27B 'webhook':30B,41B","search_c":"'0.24.0':61C 'allow':71C 'attack':86C 'azuracast':59C 'bypass':78C 'caus':100C 'client':103C 'configur':88C 'contain':62C 'expos':109C 'forgeri':68C 'groupm':91C 'guard':82C 'guzzl':102C 'http':84C 'intern':106C 'log':113C 'mastodon':89C 'permiss':76C 'point':95C 'radioreg':93C 'reach':105C 'redirect':85C,98C 'request':67C 'respons':110C 'server':65C 'server-sid':64C 'servic':107C 'side':66C 'ssrf':81C 'station':74C 'telegram':90C 'test':112C 'url':99C 'user':72C 'userurlfilt':80C 'via':111C 'vulner':69C 'webhook':75C,94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-24T15:15:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124442","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124442","severity":null,"published_at":"2026-11-08T14:18:10+00:00","modified_at":"2026-11-08T14:18:11+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","fetched_at":"2026-11-08T14:48:39+00:00","note":null}],"documents":[{"id":102068,"url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-3mcm-xm6c-fj44","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-24T15:15:36+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102069,"url":"https://www.vulncheck.com/advisories/azuracast-before-0.24.0-ssrf-filter-bypass-via-webhook-connector-redirects","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}