# CVE-2026-50552: Koel SSRF in radio station creation endpoint

Source: https://junglewise.ai/threats/cve-2026-50552-koel-ssrf-in-radio-station-creation-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-50552 · Severity: medium · CVSS 6.3 · Published 2026-06-12

Koel, a personal music streaming server, contains a vulnerability in how it handles the creation of new radio stations. An authenticated user can provide a specially crafted web address that forces the Koel server to make unauthorized requests to internal network resources. This could allow an attacker to discover private internal services or trigger actions on other systems within the corporate network that are not intended to be accessible from the internet.

Technologies: [phanan/koel (Packagist)](https://junglewise.ai/threats/technologies/phanan-koel). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-50552 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50552 being exploited in the wild.

**How severe is CVE-2026-50552?** Medium severity, with a CVSS score of 6.3, published 12 June 2026.

**Which products and versions are affected?** phanan/koel (Packagist) <= 9.7.0, ECOSYSTEM:introduced=0,fixed=9.7.1.

**Is there a fix for CVE-2026-50552?** Yes. phanan/koel (Packagist): upgrade to 9.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50552 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-50552?** Check whether you run phanan/koel (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- phanan/koel (Packagist): upgrade to 9.7.1 or later

  ```sh
  composer require phanan/koel:^9.7.1
  ```


## Technical details

A blind Server-Side Request Forgery (SSRF) exists in the POST /api/radio/stations endpoint of Koel. The vulnerability stems from a missing 'bail' keyword in the validation rules for the 'url' field in RadioStationStoreRequest.php. Because Laravel continues validation even after a rule fails, the HasAudioContentType rule executes and issues HEAD/GET requests to the user-supplied URL even if the SafeUrl rule has already flagged it as a private/reserved address. An authenticated, non-admin attacker can use the resulting error messages as a reachability oracle to perform internal port scanning and host discovery. The issue is addressed in version 9.7.1.

## Affected products

- phanan Koel <= 9.7.0

## Identifiers

- CVE-2026-50552
- GHSA-jr4p-4xjh-fwvw

## Timeline

- 2026-05-30: disclosed: Vulnerability identified via source review.
- 2026-06-04: advisory: GitHub Advisory published.
- 2026-07-15: kev added: Date published in advisory database.

## References

- [https://api.github.com/users/Yunkaiwjs](https://api.github.com/users/Yunkaiwjs)
- [https://github.com/Yunkaiwjs](https://github.com/Yunkaiwjs)
- [https://api.github.com/users/Yunkaiwjs/gists%7B/gist_id%7D](https://api.github.com/users/Yunkaiwjs/gists%7B/gist_id%7D)
- [https://api.github.com/users/Yunkaiwjs/repos](https://api.github.com/users/Yunkaiwjs/repos)
- [https://avatars.githubusercontent.com/u/235860593?v=4](https://avatars.githubusercontent.com/u/235860593?v=4)
- [https://api.github.com/users/Yunkaiwjs/events%7B/privacy%7D](https://api.github.com/users/Yunkaiwjs/events%7B/privacy%7D)

## Related threats

- [Koel SSRF via IPv6 transition address bypass in isPublicHost](https://junglewise.ai/threats/cve-2026-54494-koel-ssrf-via-ipv6-transition-address-bypass-in-ispublichost)
- [Koel SSRF in Subsonic Internet Radio Stations](https://junglewise.ai/threats/cve-2026-54493-koel-ssrf-in-subsonic-internet-radio-stations)
- [Koel authenticated blind SSRF in Subsonic podcast creation](https://junglewise.ai/threats/cve-2026-54492-koel-authenticated-blind-ssrf-in-subsonic-podcast-creation)
- [Koel SSRF in podcast and radio fetch paths](https://junglewise.ai/threats/cve-2026-54491-koel-ssrf-in-podcast-and-radio-fetch-paths)
- [Koel SSRF in Subsonic podcast feed and stream helper](https://junglewise.ai/threats/koel-ssrf-in-subsonic-podcast-feed-and-stream-helper-4a257c9c)