AzuraCast before version 0.23.8 has an SSRF vulnerability in AbstractConnector::getValidUrl(), used by Generic and Discord webhook connectors. The URL validation rejects only literal link-local IP addresses (169.254.0.0/16 or fe80::/10) but does not reject loopback or RFC1918 private IP ranges. Non-literal IP hostnames cause the IP parsing to throw an error, skipping validation entirely. Consequently, a user with station-scoped WebHooks permission can configure webhooks pointing to internal, loopback, or private network addresses, causing the server to issue outbound HTTP POST requests with the station's Now Playing data. The PUT /station/{id}/webhook/{id}/test endpoint allows triggering the request manually. No patched version was available at the time of the advisory.

An attacker with limited station-scoped WebHooks permissions can exploit this vulnerability to make the AzuraCast server send HTTP POST requests to internal or private network addresses. This SSRF can potentially be used to access or interact with internal services not normally reachable externally, leading to information disclosure (high confidentiality impact) and limited integrity impact. Availability is not affected. The vulnerability has a CVSS 3.1 score of 7.1 (high severity).

At the time of the advisory, no patch was available. Users should monitor the vendor advisory for updates and apply official fixes once released. Until then, restrict station-scoped WebHooks permissions to trusted users only and avoid configuring webhooks with untrusted URLs. No other vendor-provided mitigations or temporary fixes were indicated.