CVE-2026-121431 Details
Description
AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass the UserUrlFilter guard via the Mastodon, Telegram, GroupMe, and RadioReg connectors. Attackers can set instance_url, api, or webhookurl to internal addresses and trigger the webhook test endpoint to reach loopback, private-network, or cloud-metadata services.
A server-side request forgery (SSRF) vulnerability has been identified in AzuraCast versions prior to 0.24.0. This vulnerability allows station users with WebHooks permission to bypass the UserUrlFilter guard in the Mastodon, Telegram, GroupMe, and RadioReg webhook connectors. Attackers can manipulate user-configurable URL fields to direct requests to internal network addresses or cloud metadata services, effectively bypassing security measures intended to prevent such actions.
Users are advised to update to AzuraCast version 0.24.0 or later, and to ensure that the UserUrlFilter::filterSensitiveUserUrl() function is applied to all webhook connectors that allow user-configurable URLs. This includes the Mastodon, Telegram, GroupMe, and RadioReg connectors.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-qh22-76gf-qwc4 | [email protected] | AdvisoryTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/azuracast-before-0.24.0-ssrf-filter-bypass-via-webhook-connectors | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| AzuraCast | <= 0.23.8 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | New CVE Received | [email protected] |