Skip to content
Heist/ feed
Back to feed
High

AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs

Type: advisorySources: OSV

AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl() (backend/src/Webhook/Connector/AbstractConnector.php), used by the Generic and Discord webhook connectors, rejects only URLs whose host is a literal link-local IP address (169.254.0.0/16 or fe80::/10). Loopback addresses and RFC1918 private ranges are not rejected, and any non-literal-IP hostname causes the IP parsing call to throw, which skips the check entirely. A user holding only the station-scoped WebHooks permission can therefore configure a webhook pointing at an internal, loopback, or private-network target and cause the server to issue an outbound HTTP POST containing the station's Now Playing data, resulting in server-side request forgery. The PUT /station/{id}/webhook/{id}/test endpoint allows the same low-privileged user to trigger the request on demand. At the time of the advisory no patched version was available.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-100849
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 15:52 UTC · Revision 1

Source evidence

AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs

core-osv · Original source

Published 27 Sept 2026, 01:28 UTC

AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl() (backend/src/Webhook/Connector/AbstractConnector.php), used by the Generic and Discord webhook connectors, rejects only URLs whose host is a literal link-local IP address (169.254.0.0/16 or fe80::/10). Loopback addresses and RFC1918 private ranges are not rejected, and any non-literal-IP hostname causes the IP parsing call to throw, which skips the check entirely. A user holding only the station-scoped WebHooks permission can therefore configure a webhook pointing at an internal, loopback, or private-network target and cause the server to issue an outbound HTTP POST containing the station's Now Playing data, resulting in server-side request forgery. The PUT /station/{id}/webhook/{id}/test endpoint allows the same low-privileged user to trigger the request on demand. At the time of the advisory no patched version was available.

osv:CVE-2026-100849
Complete source record
{
  "id": "8f375e80c660b5ade791ec89195cf56e4e34e0b92d6f8b3691da292230eb4360",
  "url": "https://osv.dev/vulnerability/CVE-2026-100849",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs",
    "summary": "AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl() (backend/src/Webhook/Connector/AbstractConnector.php), used by the Generic and Discord webhook connectors, rejects only URLs whose host is a literal link-local IP address (169.254.0.0/16 or fe80::/10). Loopback addresses and RFC1918 private ranges are not rejected, and any non-literal-IP hostname causes the IP parsing call to throw, which skips the check entirely. A user holding only the station-scoped WebHooks permission can therefore configure a webhook pointing at an internal, loopback, or private-network target and cause the server to issue an outbound HTTP POST containing the station's Now Playing data, resulting in server-side request forgery. The PUT /station/{id}/webhook/{id}/test endpoint allows the same low-privileged user to trigger the request on demand. At the time of the advisory no patched version was available.",
    "evidence": "osv:CVE-2026-100849",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-100849",
      "aliases": [
        "CVE-2026-100849",
        "GHSA-3jp3-3wqw-jvw4"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/azuracast/azuracast",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "62a30e5342ee8e571e02c832d7d2e9809bc81fae"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.23.8"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.23.8"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "0.23.7",
            "0.23.6",
            "0.23.5",
            "0.23.4",
            "0.23.3",
            "0.23.2",
            "0.23.1",
            "0.23.0",
            "0.22.1",
            "0.22.0",
            "0.21.0",
            "0.20.4",
            "0.20.3",
            "0.20.2",
            "0.20.1",
            "0.20.0",
            "0.19.7",
            "0.19.6",
            "0.19.5",
            "0.19.4",
            "0.19.3",
            "0.19.2",
            "0.19.1",
            "0.19.0",
            "0.18.5",
            "0.18.3",
            "0.18.2",
            "0.18.1",
            "0.18.0",
            "0.17.7",
            "0.17.6",
            "0.17.5",
            "0.17.4",
            "0.17.3",
            "0.17.2",
            "0.17.1",
            "0.17.0",
            "0.16.1",
            "0.16.0",
            "0.15.2",
            "0.15.1",
            "0.15.0",
            "0.14.1",
            "0.10.2",
            "0.10.1",
            "0.10.0",
            "0.9.9",
            "0.9.8.1",
            "0.9.8",
            "0.9.7.1",
            "0.9.7",
            "0.9.6.5",
            "0.9.6.2",
            "0.9.6.1",
            "0.9.6",
            "0.9.5.1",
            "0.9.5",
            "0.9.4.2",
            "0.9.4.1",
            "0.9.4",
            "0.9.3",
            "0.9.2",
            "0.9.1",
            "0.9.0",
            "0.8.0",
            "0.6.0",
            "0.5.0",
            "0.3.3",
            "0.3.2",
            "0.3.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100849.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:51.373233150Z",
      "provider": "osv",
      "references": [
        "https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-3jp3-3wqw-jvw4",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100849.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100849",
        "https://www.vulncheck.com/advisories/azuracast-before-0.23.8-ssrf-filter-bypass-via-hostname-and-private-ips"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-918"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100849.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-100849",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 519807,
  "published_at": "2026-09-27T01:28:42.974+00:00"
}