High-Risk SSRF Vulnerabilities in AzuraCast Webhook and Remote Relay Features

• •AzuraCast has critical SSRF vulnerabilities affecting webhook and remote relay features.
• •CVE-2026-100849 allows low-privileged users to exploit internal network services.
• •No patches are available, increasing the risk for internet-accessible deployments.

AzuraCast, a self-hosted web radio management suite, has been found to have critical server-side request forgery (SSRF) vulnerabilities in its webhook and remote relay functionalities. The vulnerabilities, identified as CVE-2026-100849, allow users with limited permissions to configure webhooks and remote relays that can target internal network services, potentially leading to data exposure and internal reconnaissance. The webhook URL validation only rejects literal link-local IP addresses, while the remote relay feature lacks any host/IP restrictions. Attackers can exploit these vulnerabilities if they have access to the management interface and the necessary low-level permissions. As of the advisory date, no patched version is available, making the risk particularly high for internet-accessible deployments. Security professionals are urged to review webhook configurations and restrict access to trusted users. The vulnerabilities were disclosed on September 27, 2026, and are currently unpatched.