EUVD-2026-87840

AzuraCast Composer package azuracast/azuracast before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme Utilities\Urls::parseUserUrl, used by StationRemote::getUrlAsUri and performs no host or IP address restriction. A user holding only the station-scope...

CVE-2026-100848 AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL

AzuraCast Composer package azuracast/azuracast before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme Utilities\Urls::parseUserUrl, used by StationRemote::getUrlAsUri and performs no host or IP address restriction. A user holding only the station-scope...

CVE-2026-100848

AzuraCast versions before 0.23.8 (specifically the azuracast/azuracast Composer package) are vulnerable to Server-Side Request Forgery (SSRF) . The root cause is that the software validates the "Remote Relay" URL only for syntax and scheme (http/https) via Utilitiesase\Urls::parseUserUrl, but fa...