CVE-2026-121431

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.24.0

Description Station users with WebHooks permission can bypass the UserUrlFilter guard using the Mastodon, Telegram, GroupMe, and RadioReg connectors. By setting the instance url, api, or webhookurl variables to internal addresses and triggering the webhook test endpoint, an attacker can perform a server-side request forgery (SSRF) to access loopback, private-network, or cloud-metadata services. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations Update to version 0.24.0 or later.