The vulnerability arises because Koel's fix for CVE-2026-47260 applied redirect-target validation only to one fetch path (EpisodePlayable) but not others. Most server-side fetchers perform an initial isSafeUrl() check without per-redirect-hop validation, allowing HTTP 302 redirects to internal addresses to bypass checks. DNS rebinding attacks are also possible because DNS is resolved separately at validation and connection time without IP pinning. Authenticated users can supply URLs that redirect to internal or cloud metadata endpoints, causing SSRF. This affects multiple fetch paths reachable via native and Subsonic APIs, including podcast addition, refresh, and internet radio features. The vulnerability enables access to internal services and cloud metadata (e.g., AWS IMDSv1), potentially leaking sensitive credentials.

An authenticated user with any privilege level can exploit SSRF to access internal network resources, including cloud instance metadata services that may expose IAM credentials. This can lead to unauthorized disclosure of sensitive internal information and potential further compromise of the hosting environment. The vulnerability affects multiple API endpoints and features, increasing the attack surface. The impact is high confidentiality loss with limited integrity and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has partially fixed the issue in one fetch path but not others. Until a comprehensive fix is released, avoid using affected Koel versions prior to 9.7.1 or restrict authenticated user capabilities to trusted users only. Monitor vendor communications for an official patch that applies redirect-target validation and DNS rebinding protections consistently across all fetch paths.