CVE-2026-124442: AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connector Redirects

Published Nov 8, 2026

Updated

AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows users with station WebHooks permission to bypass the UserUrlFilter SSRF guard through HTTP redirects. Attackers can configure Mastodon, Telegram, GroupMe, or RadioReg webhooks pointing to a redirecting URL, causing the Guzzle client to reach internal services and expose responses via test logs.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade AzuraCast to a version that resolves this vulnerability.
Fixed in 0.24.0

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs an account or other access that grants the station WebHooks permission. They can use the affected Mastodon, Telegram, GroupMe, or RadioReg webhook connectors.

What does the attacker need to do to reach internal services?

They must configure a webhook with a URL that redirects to the internal target. The redirect bypasses the UserUrlFilter SSRF protection when the Guzzle client follows it.

How could an administrator tell whether the issue has been exploited?

Review webhook test logs for responses from unexpected internal services, especially where a configured webhook URL redirects. The vulnerability can expose internal service responses through those test logs.

What can be done if upgrading is not immediately possible?

Restrict station WebHooks permission to trusted users and avoid using redirecting webhook URLs with the affected connectors. Review existing Mastodon, Telegram, GroupMe, and RadioReg webhook configurations for redirect behavior.

CVE-2026-124442: AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connector Redirects

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What does the attacker need to do to reach internal services?

How could an administrator tell whether the issue has been exploited?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does the attacker need to do to reach internal services?

How could an administrator tell whether the issue has been exploited?

What can be done if upgrading is not immediately possible?