EUVD-2026-87840
GHSA-xrr6-hwgm-2r77
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with station RemoteRelays permission
-
DeliverySet Remote Relay URL to metadata/loopback address
-
ExploitBackground Now Playing sync issues forged request
-
ExecutionServer reaches internal/metadata endpoint
-
ImpactHarvest internal data or cloud IAM credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account holding the station-scoped RemoteRelays permission on an AzuraCast instance before 0.23.8; the attacker sets a station's Remote Relay URL to an http/https address pointing at loopback, private-network, or cloud-metadata IPs. Exploitation is limited to what the automatic background Now Playing sync (AbstractRemote::getNowPlayingAsync) fetches, and to the internal endpoints reachable from the server; it does not require user interaction after the URL is saved. Limiting factors: the RemoteRelays permission gate (not unauthenticated), and elevated impact depends on the server residing in a cloud environment with an accessible metadata service or reachable internal services. No patched version is available, so no upgrade remediation exists yet. |
| Impact | The vendor-supplied CVSS 4.0 vector (7.1, AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N) describes a network-reachable, low-complexity SSRF that requires an authenticated user holding the station-scoped RemoteRelays permission (PR:L) - so this is NOT an unauthenticated internet-facing flaw. The primary impact is confidentiality (VC:H): an attacker can coerce the server into reaching cloud-metadata endpoints (169.254.169.254) to harvest IAM credentials, or map/reach internal-only services on loopback and private networks. No EPSS score, no CISA KEV listing, and no POC are present in the provided intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Notably, no patched version exists yet (the advisory targets the main branch as of commit bcf8754, before 0.23.8), which raises defensive urgency despite the modest CVSS and the low real-world footprint of AzuraCast. The realistic risk is moderate and gated: exploitation is trivial once an attacker has the RemoteRelays permission, and the automatic background Now Playing sync makes the SSRF fire repeatedly without further interaction, but the requirement for an authenticated station role and the niche deployment base limit widespread mass-exploitation. |
| Exploit ScenarioDerived | An authenticated AzuraCast user (or a compromised low-privilege account) with only the station-scoped RemoteRelays permission sets a station's Remote Relay URL to http://169.254.169.254/latest/meta-data/ or an internal http://127.0.0.1:<port>/ address. AzuraCast's periodic background Now Playing sync then automatically and repeatedly issues HTTP requests to that address, forging requests against internal resources and potentially returning cloud-metadata IAM credentials. No public POC is identified in the provided data, but exploitation complexity is low (AC:L) and needs no user interaction beyond saving the URL. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 27, 2026
Server-side request forgery in AzuraCast (Composer package azuracast/azuracast, versions before 0.23.8 per the advisory) lets an authenticated user who holds the station-scoped RemoteRelays permission set a station's Remote Relay URL to loopback, private-network, or cloud-metadata addresses such as http://127.0.0.1:<port>/ or http://169.254.169.254/latest/meta-data/. Because the URL is validated only for syntax and an http/https scheme, the platform's periodic background Now Playing sync (AbstractRemote::getNowPlayingAsync) then automatically and repeatedly fetches that attacker-chosen address on the server's behalf, yielding blind SSRF against internal services and - on cloud-hosted instances with a reachable metadata endpoint - potentially exposing instance credentials or configuration. This is not an unauthenticated internet-facing flaw: exploitation requires an authenticated account with the RemoteRelays permission (PR:L in both the vendor's CVSS 4.0 vector and our CVSS 3.1 assessment), there is no public exploit code identified at time of analysis, and no patched release was confirmed at the time of the advisory.
RemediationAI
No vendor-released patch was identified at the time of analysis: the advisory states that no patched version is available and that the main branch at commit bcf8754eef3a268ad82c3db4d81f7920c3c28b56 is affected, even though releases before 0.23.8 are named as the impacted line, so upgrade remediation cannot yet be relied upon and the status should be re-checked against https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-4h6m-rrxm-7w3m and https://www.vulncheck.com/advisories/azuracast-before-0.23.8-server-side-request-forgery-via-remote-relay-url before any fix is adopted. Highest-value compensating control is eliminating the privilege prerequisite: audit station users and revoke the RemoteRelays permission from every role that does not strictly need it, which removes the attack path entirely at the cost of blocking legitimate remote-relay configuration for those operators. Second, constrain what the AzuraCast server can reach: apply host-level and network-firewall egress rules denying the service account access to 127.0.0.0/8, RFC1918 ranges, and the link-local 169.254.0.0/16 block, accepting that this also breaks any legitimate Remote Relay or stream source hosted on an internal network. Third, harden the cloud metadata path specifically - require IMDSv2 on AWS (token-based access defeats simple GET-based SSRF), keep the GCP/Azure metadata services requiring their mandatory request headers, or firewall the metadata IP from the AzuraCast host outright; the trade-off is that instances legitimately relying on instance-profile credentials fetched by other software may break. Fourth, monitor and alert on outbound HTTP requests originating from the AzuraCast service account, especially repeated requests to loopback, private, or metadata addresses fired by the Now Playing synchronization schedule, as a detection measure rather than a preventive one. Finally, treat this as an authenticated low-privilege SSRF rather than an internet-exposed flaw - if the instance is multitenant or grants station-scoped permissions to untrusted users, scoping or temporarily disabling Remote Relay configuration is warranted until the vendor ships a fix that adds host/IP validation in Utilities\Urls::parseUserUrl or StationRemote::getUrlAsUri.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AzuraCast is a self-hosted PHP web radio management suite distributed as the Composer package azuracast/azuracast, and the CPE record cpe:2.3:a:azuracast:azuracast:*:*:*:*:*:*:*:* matches all released versions rather than a bounded range, so the advisory's own boundary matters: versions before 0.23.8 are described as affected, and the main branch at commit bcf8754eef3a268ad82c3db4d81f7920c3c28b56 (2026-07-31) is also affected, with no patched version available at advisory time. The root cause is CWE-918 (Server-Side Request Forgery): the helper Utilities\Urls::parseUserUrl, reached through StationRemote::getUrlAsUri when an operator configures a station's Remote Relay, enforces only URL syntax and an http/https scheme and applies no hostname allowlist, no resolution check, and no block on loopback, RFC1918 private ranges, or link-local/cloud-metadata addresses. The input is therefore treated as a trusted destination. The second half of the flaw is architectural: AzuraCast's Now Playing synchronization runs on a recurring background schedule via AbstractRemote::getNowPlayingAsync, so once the URL is stored the server itself initiates the outbound request repeatedly and without any further user interaction. That server-origin request is what lets a low-privilege station operator pivot from a URL field into the internal network - the impact ceiling depends on what the AzuraCast host can reach, with cloud metadata services (for example 169.254.169.254) being the highest-value target because responses may carry scoped instance credentials, while the classic blind-SSRF limitations (the response body is consumed by the Now Playing parser rather than returned verbatim) temper direct data exfiltration.
Know when Azuracast gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable SSRF exploitable by a low-privilege RemoteRelays user (PR:L), no interaction; high confidentiality via metadata/internal reads, minor integrity from forged requests, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
AzuraCast (Composer package azuracast/azuracast) before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme (Utilities\Urls::parseUserUrl, used by StationRemote::getUrlAsUri) and performs no host or IP address restriction. A user holding only the station-scoped RemoteRelays permission can therefore set a Remote Relay URL pointing at loopback, private-network, or cloud-metadata addresses (e.g. http://127.0.0.1:<port>/ or http://169.254.169.254/latest/meta-data/), and AzuraCast's periodic background Now Playing sync (AbstractRemote::getNowPlayingAsync) will automatically and repeatedly issue HTTP requests to that address, resulting in server-side request forgery against internal resources. This affects the main branch as of commit bcf8754eef3a268ad82c3db4d81f7920c3c28b56 (2026-07-31); no patched version is available at the time of the advisory.
Technical POC Analysis
CWE-918 (Server-Side Request Forgery).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
AzuraCast, the self-hosted radio station management platform used by many organizations to run streaming operations, contains a high-severity server-side request forgery flaw that lets a user holding the station-level Remote Relays permission redirect the platform's automatic Now Playing lookups toward internal or cloud metadata services. The practical consequence is concentrated on cloud-hosted deployments: a single trusted station operator account, if misused or compromised, could surface instance credentials or configuration that also protect adjacent workloads. Leadership should treat this as a potential lateral-movement and cloud-account risk rather than a narrow streaming-platform bug, because the platform itself becomes the vehicle for reaching systems outside the radio service.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict the station-scoped RemoteRelays permission to the smallest possible trusted administrator group and audit existing holders; audit and remove any Remote Relay URLs pointing to loopback, private-network, or cloud-metadata addresses; apply network egress filtering to block server-originated traffic to 127.0.0.0/8, RFC1918, and 169.254.169.254; enforce IMDSv2 or disable the instance metadata service on cloud hosts running AzuraCast; segment the AzuraCast host from internal management and data services; monitor and alert on outbound requests from AzuraCast to internal or metadata endpoints; and rotate cloud instance credentials and secrets that could have been reachable from an affected host.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Related Vulnerabilities in AzuraCast SSRF, Injection, and Access Control Flaws
View all 11Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3. Rate
Cross-site Scripting (XSS) - Stored in GitHub repository azuracast/azuracast prior to 0.18. Rated medium severity (CVSS
Remote code execution in AzuraCast ≤0.23.8 is reachable by any authenticated station manager due to a serialization grou
Unauthenticated HTTP requests to AzuraCast 0.23.1's internal sftpgo integration endpoints (/api/internal/sftp-auth and /
Exploit-DB