Server-Side Request Forgery (SSRF)

Koel is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of IPv6 transition addresses in the outbound URL guard, which allows an attacker to bypass SSRF protections and access internal services or cloud metadata endpoints through a malicious RSS feed...