CVE-2026-121431

AzuraCast versions before 0.24.0 are vulnerable to a Server-Side Request Forgery (SSRF) flaw. Station users with WebHooks permission can bypass the UserUrlFilter guard using the Mastodon, Telegram, GroupMe, and RadioReg connectors. By setting the instance_url, api, or webhookurl parameters to int...