CVE-2026-100849
Received Received - Intake

AzuraCast Webhook SSRF via Invalid URL Validation

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl() (backend/src/Webhook/Connector/AbstractConnector.php), used by the Generic and Discord webhook connectors, rejects only URLs whose host is a literal link-local IP address (169.254.0.0/16 or fe80::/10). Loopback addresses and RFC1918 private ranges are not rejected, and any non-literal-IP hostname causes the IP parsing call to throw, which skips the check entirely. A user holding only the station-scoped WebHooks permission can therefore configure a webhook pointing at an internal, loopback, or private-network target and cause the server to issue an outbound HTTP POST containing the station's Now Playing data, resulting in server-side request forgery. The PUT /station/{id}/webhook/{id}/test endpoint allows the same low-privileged user to trigger the request on demand. At the time of the advisory no patched version was available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-100849
EUVD
EUVD-2026-87839

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
azuracast azuracast to 0.23.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in AzuraCast before version 0.23.8. The issue occurs in the webhook URL validation function which only blocks link-local IP addresses but allows loopback addresses, RFC1918 private IPs, and hostnames. This lets users with low privileges (station-scoped WebHooks permission) configure webhooks pointing to internal targets, causing the server to make unauthorized outbound HTTP requests containing sensitive station data.

Detection Guidance

Check AzuraCast logs for outbound HTTP requests from the webhook system, particularly to internal or unexpected targets. Review webhook configurations for URLs pointing to loopback, private, or RFC1918 addresses. Use network monitoring tools to detect unauthorized outbound connections from the AzuraCast host.

Impact Analysis

An attacker could access internal services on the host machine, interact with other containers or services on private networks, perform internal network reconnaissance, conduct port scanning, or reach cloud metadata services. The vulnerability allows exfiltration of Now Playing data and potential further network compromise with low-privileged access.

Compliance Impact

This vulnerability could lead to unauthorized data exfiltration of sensitive station information, potentially violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. The unauthorized internal network access may also breach compliance requirements for network segmentation and access controls.

Mitigation Strategies

Upgrade AzuraCast to version 0.23.8 or later if available. If no patch exists, restrict webhook permissions to trusted users and block outbound requests to private IP ranges at the firewall level. Disable the test endpoint until a fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100849. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart