Executive brief
Koel, a personal music streaming server, contains a vulnerability in how it handles the creation of new radio stations. An authenticated user can provide a specially crafted web address that forces the Koel server to make unauthorized requests to internal network resources. This could allow an attacker to discover private internal services or trigger actions on other systems within the corporate network that are not intended to be accessible from the internet.
Technical details
A blind Server-Side Request Forgery (SSRF) exists in the POST /api/radio/stations endpoint of Koel. The vulnerability stems from a missing 'bail' keyword in the validation rules for the 'url' field in RadioStationStoreRequest.php. Because Laravel continues validation even after a rule fails, the HasAudioContentType rule executes and issues HEAD/GET requests to the user-supplied URL even if the SafeUrl rule has already flagged it as a private/reserved address. An authenticated, non-admin attacker can use the resulting error messages as a reachability oracle to perform internal port scanning and host discovery. The issue is addressed in version 9.7.1.
Affected products
- phanan Koel <= 9.7.0
Timeline
- 2026-05-30: disclosed: Vulnerability identified via source review.
- 2026-06-04: advisory: GitHub Advisory published.
- 2026-07-15: kev added: Date published in advisory database.