CVE-2026-100849

AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl backend/src/Webhook/Connector/AbstractConnector.php, used by the Generic and Discord webhook connectors, rejects only URLs whose host is a litera...

CVE-2026-100849 AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs

AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl backend/src/Webhook/Connector/AbstractConnector.php, used by the Generic and Discord webhook connectors, rejects only URLs whose host is a litera...

CVE-2026-100849

AzuraCast, a self-hosted web radio management suite, is vulnerable to Server-Side Request Forgery (SSRF) in versions before 0.23.8 . The flaw exists in the AbstractConnector::getValidUrl() function (backend/src/Webhook/Connector/AbstractConnector.php) used by the Generic and Discord webhook conne...

CVE-2026-100849 AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs

AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl backend/src/Webhook/Connector/AbstractConnector.php, used by the Generic and Discord webhook connectors, rejects only URLs whose host is a litera...

CVE-2026-100849 AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs

AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl backend/src/Webhook/Connector/AbstractConnector.php, used by the Generic and Discord webhook connectors, rejects only URLs whose host is a litera...

CVE-2026-100849: Server-Side Request Forgery (SSRF)

AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl backend/src/Webhook/Connector/AbstractConnector.php, used by the Generic and Discord webhook connectors, rejects only URLs whose host is a litera...