# CVE-2026-124442: AzuraCast server-side request forgery via webhook redirects

Source: https://junglewise.ai/threats/cve-2026-124442-azuracast-before-0-24-0-contains-a-server-side-request-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-124442 · Severity: medium · CVSS 6.5 · Published 2026-11-08

AzuraCast is an open-source web radio platform that allows users to configure webhooks to external services like Mastodon and Telegram. A user with webhook permissions can bypass the server's security filter by using HTTP redirects to make the server request internal services, potentially exposing sensitive metadata or credentials. This could allow an attacker to read internal data or interact with restricted systems without direct access.

Technologies: [AzuraCast](https://junglewise.ai/threats/technologies/azuracast). Vendors: [AzuraCast](https://junglewise.ai/threats/vendors/azuracast).

## Quick answers

**Is CVE-2026-124442 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-124442 being exploited in the wild.

**How severe is CVE-2026-124442?** Medium severity, with a CVSS score of 6.5, published 8 November 2026.

**Which products and versions are affected?** AzuraCast before 0.24.0.

**Is there a fix for CVE-2026-124442?** Yes: fixed in 0.24.0. Until then: Set RequestOptions::ALLOW_REDIRECTS to false on outbound webhook requests in Mastodon.php, Telegram.php, GroupMe.php, and RadioReg.php, or disable redirect-following globally for all webhook and remote HTTP clients in Guzzle configuration.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-24"},{"kind":"advisory","at":"2026-11-08"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-124442 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-124442?** Check whether you run AzuraCast at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.24.0

Set RequestOptions::ALLOW_REDIRECTS to false on outbound webhook requests in Mastodon.php, Telegram.php, GroupMe.php, and RadioReg.php, or disable redirect-following globally for all webhook and remote HTTP clients in Guzzle configuration.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-24"},{"kind":"advisory","at":"2026-11-08"}]

## Technical details

The UserUrlFilter validates the initial user-supplied URL's host to prevent SSRF attacks, but the Guzzle HTTP client follows 3xx redirects by default without re-validating the target. Users with station WebHooks permission can configure Mastodon, Telegram, GroupMe, or RadioReg webhooks pointing to an open redirector, causing the server to follow redirects to internal addresses (127.0.0.1, 169.254.169.254, etc.) that bypass the filter. Internal response bodies are logged and can be read via the test-log endpoint.

## Affected products

- AzuraCast AzuraCast before 0.24.0

## References

- [https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-3mcm-xm6c-fj44](https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-3mcm-xm6c-fj44)
- [https://www.vulncheck.com/advisories/azuracast-before-0.24.0-ssrf-filter-bypass-via-webhook-connector-redirects](https://www.vulncheck.com/advisories/azuracast-before-0.24.0-ssrf-filter-bypass-via-webhook-connector-redirects)

## Related threats

- [AzuraCast CSV formula injection in bulk media import](https://junglewise.ai/threats/cve-2026-121433-azuracast-before-0-24-0-contains-a-stored-csv-formula-injection)
- [AzuraCast webhook connectors server-side request forgery filter bypass](https://junglewise.ai/threats/cve-2026-121431-azuracast-before-0-24-0-contains-a-server-side-request-forgery)
- [AzuraCast missing authorization in waveform endpoints](https://junglewise.ai/threats/cve-2026-121430-azuracast-before-0-24-0-contains-a-missing-authorization)
- [AzuraCast command injection in StereoTool configuration](https://junglewise.ai/threats/cve-2026-121429-azuracast-through-0-23-8-contains-a-command-injection)
- [AzuraCast code injection in timezone field](https://junglewise.ai/threats/cve-2026-121428-azuracast-through-0-23-8-contains-a-remote-code-execution)