CVE-2026-121431: AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectors
AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass the UserUrlFilter guard via the Mastodon, Telegram, GroupMe, and RadioReg connectors. Attackers can set instanceurl, api, or webhookurl to internal addresses and trigger the webhook test endpoint to reach loopback, private-network, or cloud-metadata services.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a station user account with the WebHooks permission. No additional user interaction is required, and the vulnerable webhook test endpoint can then be used to initiate requests.
Which webhook connectors are affected?
The bypass affects the Mastodon, Telegram, GroupMe, and RadioReg connectors. The relevant connector URL fields are instance_url, api, and webhookurl.
What internal targets can be reached?
The issue can be used to send requests to loopback addresses, private-network services, and cloud-metadata services. This can expose services that are not directly reachable from outside the deployment.
What version resolves the issue?
AzuraCast versions before 0.24.0 are affected. Updating to 0.24.0 or later addresses the stated affected-version range.