CVE-2026-100848
Received Received - Intake

SSRF in AzuraCast via Unrestricted Remote Relay URL

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
AzuraCast (Composer package azuracast/azuracast) before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme (Utilities\Urls::parseUserUrl, used by StationRemote::getUrlAsUri) and performs no host or IP address restriction. A user holding only the station-scoped RemoteRelays permission can therefore set a Remote Relay URL pointing at loopback, private-network, or cloud-metadata addresses (e.g. http://127.0.0.1:<port>/ or http://169.254.169.254/latest/meta-data/), and AzuraCast's periodic background Now Playing sync (AbstractRemote::getNowPlayingAsync) will automatically and repeatedly issue HTTP requests to that address, resulting in server-side request forgery against internal resources. This affects the main branch as of commit bcf8754eef3a268ad82c3db4d81f7920c3c28b56 (2026-07-31); no patched version is available at the time of the advisory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-100848
EUVD
EUVD-2026-87840

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
azuracast azuracast to 0.23.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in AzuraCast versions before 0.23.8. It occurs because the application only checks if a Remote Relay URL has a valid http/https scheme and proper syntax, without restricting the host or IP address. A user with limited RemoteRelays permissions can set this URL to point to internal, loopback, private, or cloud-metadata addresses. The application then automatically makes repeated HTTP requests to these addresses during its background sync process, enabling SSRF attacks against internal resources.

Detection Guidance

Check AzuraCast logs for repeated HTTP requests to internal or unexpected addresses. Inspect station Remote Relay URLs in the admin panel for loopback (127.0.0.1), private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local (169.254.0.0/16), or cloud metadata (169.254.169.254) IPs.

Impact Analysis

An attacker with station-scoped RemoteRelays permissions could exploit this to perform internal network reconnaissance or interact with internal-only services. The vulnerability allows low-privilege users to trigger HTTP requests to restricted addresses like 127.0.0.1 or private networks, potentially exposing sensitive internal data or enabling further attacks on internal systems.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to internal systems, potentially exposing sensitive data. For GDPR, this may result in violations related to unauthorized data access or processing. For HIPAA, it could compromise protected health information if internal systems are accessed. Both regulations require strict access controls and data protection measures, which this vulnerability undermines.

Mitigation Strategies

Disable the Remote Relay feature if not needed. Restrict RemoteRelays permission to trusted users. Implement network-level controls to block outbound requests to internal IPs from the AzuraCast server. Monitor for unusual outbound HTTP traffic patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100848. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart