Koel v9.5.0's POST /api/radio/stations endpoint validates the 'url' field with multiple rules but lacks the 'bail' keyword to stop validation on failure. The SafeUrl rule correctly rejects private or reserved IP addresses, but due to missing bail, the subsequent HasAudioContentType rule still performs HTTP HEAD and streaming GET requests to the supplied URL without IP validation. This results in a blind SSRF vulnerability exploitable by any authenticated user. The vulnerability allows the server to make requests to internal network hosts, enabling an internal reachability oracle through distinct validation error messages. The endpoint is protected only by authentication, with no admin or permission checks. The affected version is Koel prior to 9.7.1.

An authenticated low-privilege user can cause the server to make HTTP requests to arbitrary internal network addresses, potentially discovering live internal hosts and open ports via differing validation error messages. Although the SSRF is blind and does not return response bodies, it can be used as a reliable internal network scanning oracle. Additionally, the server may trigger side-effect actions on internal endpoints that respond to GET or HEAD requests. This impacts confidentiality (information disclosure of internal network reachability), integrity (possible state changes on internal services), and availability (potentially causing internal service disruptions).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint to trusted users only and consider implementing additional validation to ensure that no HTTP requests are made to private or reserved IP addresses. Applying the 'bail' validation rule to stop further validation after SafeUrl failure would prevent the SSRF. Monitor vendor communications for an official patch or update to Koel version 9.7.1 or later, which presumably addresses this issue.