---
id: "CVE-2026-124442"
page: "https://infrastack.ai/live/CVE-2026-124442"
kind: "vulnerability"
aliases: ["CVE-2026-124442"]
title: "AzuraCast: station webhook users can reach internal services via redirects"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["azuracast", "package", "radio", "self-hosted"]
not_affected_if: ["azuracast-0.24.0-or-later", "no-webhook-permission-users"]
published_at: "2026-11-08T14:18:10+00:00"
first_seen_at: "2026-11-08T14:48:39+00:00"
updated_at: "2026-11-08T14:49:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124442", "first_seen_at": "2026-11-08T14:48:39+00:00"}]
exploit_sources: []
---

# AzuraCast: station webhook users can reach internal services via redirects

Link for people: https://infrastack.ai/live/CVE-2026-124442 (this .md is for agents)

AzuraCast before 0.24.0 lets users with station WebHooks permission bypass its URL filter by using HTTP redirects in webhook targets. An attacker can make the server request internal services and read the responses in test logs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the AzuraCast version in the installation; `0.24.0` or later is not affected by this CVE
- Review which users hold the station WebHooks permission

## Fix

- AzuraCast: move to `0.24.0` or later

## Timeline

- 2026-11-08T14:48:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124442

## Documents

- [advisory] Vendor advisory: github.com https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-3mcm-xm6c-fj44
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/azuracast-before-0.24.0-ssrf-filter-bypass-via-webhook-connector-redirects

## From the sources

AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows users with station WebHooks permission to bypass the UserUrlFilter SSRF guard through HTTP redirects. Attackers can configure Mastodon, Telegram, GroupMe, or RadioReg webhooks pointing to a redirecting URL, causing the Guzzle client to reach internal services and expose responses via test logs.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_