CVE-2026-124442

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.24.0

Description Users with station WebHooks permission can bypass the UserUrlFilter SSRF guard using HTTP redirects. By configuring webhooks for Mastodon, Telegram, GroupMe, or RadioReg to point to a redirecting URL, the Guzzle client can be forced to access internal services and expose the responses through test logs. Server-Side Request Forgery (SSRF) is a flaw where an attacker induces a server-side application to make requests to an unintended location.

Recommendations Update to version 0.24.0 or later.