CVE-2026-100848

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.8

Description Insufficient validation of a station's Remote Relay URL allows a user with station-scoped RemoteRelays permissions to perform server-side request forgery (SSRF). The system only checks for URL syntax and http/https schemes via the parseUserUrl() function (used by getUrlAsUri()), failing to restrict host or IP addresses. This allows the configuration of URLs pointing to loopback, private-network, or cloud-metadata addresses. Consequently, the periodic background Now Playing sync performed by the getNowPlayingAsync() function automatically issues HTTP requests to these internal resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.