Executive brief
Koel, a personal music streaming server, is vulnerable to a security flaw that allows authenticated users to force the server to make unauthorized requests to internal network resources. This could allow an attacker to access sensitive internal data, such as cloud infrastructure credentials or private administrative panels, by bypassing existing security filters. The issue stems from an incomplete previous fix that failed to account for malicious web redirects and DNS manipulation.
Technical details
This vulnerability is a systemic SSRF resulting from an incomplete remediation of CVE-2026-47260. While an initial 'isSafeUrl' check was added, most fetchers (including synchronizeEpisodes, getStreamableUrl, and AddRadioStation) lack per-hop redirect validation and IP pinning. An attacker can bypass the point-in-time host check using a 302 redirect to an internal IP or via DNS rebinding (TOCTOU). The vulnerability is reachable via both the native API and Subsonic API. A fix is available in version 9.7.1 which centralizes outbound HTTP requests through a middleware that validates every redirect hop and pins resolved IPs.
Affected products
- phanan Koel <= 9.7.0
Timeline
- 2026-06-04: disclosed: Initial report to vendor
- 2026-06-04: patched: Version 9.7.1 released
- 2026-07-15: advisory: GitHub Advisory published
References
- https://api.github.com/users/kiffa-australis256
- https://github.com/kiffa-australis256
- https://api.github.com/users/kiffa-australis256/gists%7B/gist_id%7D
- https://api.github.com/users/kiffa-australis256/repos
- https://avatars.githubusercontent.com/u/289640798?v=4
- https://api.github.com/users/kiffa-australis256/events%7B/privacy%7D