AzuraCast versions before 0.23.8 contain a server-side request forgery (SSRF) vulnerability in the station webhook URL validation. The validation incorrectly rejects only literal link-local IP addresses but allows loopback and private network addresses, enabling a user with station-scoped WebHooks permission to configure webhooks targeting internal or private network resources. This can cause the server to send HTTP POST requests with station data to unintended internal endpoints. The vulnerability can be triggered on demand via a specific test endpoint. No patch was available at the time of the advisory.