AzuraCast versions before 0.23.8 have a vulnerability where the 'Remote Relay' URL is only validated for syntax and scheme, without host or IP restrictions. This allows users with station-scoped RemoteRelays permission to set URLs pointing to internal or sensitive addresses, causing the server to make repeated HTTP requests to these addresses. This results in server-side request forgery (SSRF). No patch is currently available for this issue.