CVE-2026-124442 AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connector Redirects
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124442?
CVE-2026-124442 is a high-severity vulnerability in AzuraCast, published on 8 Nov 2026.
Official description
AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows users with station WebHooks permission to bypass the UserUrlFilter SSRF guard through HTTP redirects. Attackers can configure Mastodon, Telegram, GroupMe, or RadioReg webhooks pointing to a redirecting URL, causing the Guzzle client to reach internal services and expose responses via test logs.
Weakness: CWE-918
Which versions are affected by CVE-2026-124442?
How do I fix CVE-2026-124442?
No fix has been published for CVE-2026-124442 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124442 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-124442 exists.
Sources
Also known as GHSA-3mcm-xm6c-fj44, GHSA-wmfw-2xfp-7mvx.