AzuraCast instances prior to version 0.23.8 validate the format of a station’s Remote Relay URL but do not restrict the host or IP address. A user with the station‑scoped RemoteRelays permission can configure a URL that points to loopback addresses, private‑network ranges, or cloud provider metadata services. The application’s background Now Playing synchronisation process automatically issues HTTP requests to the configured URL, thereby allowing an attacker to force AzuraCast to make HTTP calls to internal resources – a classic Server‑Side Request Forgery scenario.

The vulnerability affects the AzuraCast project (azuracast/azuracast) for all releases before 0.23.8, including the main branch as of commit bcf8754e (2026‑07‑31).

With a CVSS score of 7.1 the vulnerability is considered High severity. Although EPSS is not available and the issue is not listed in the CISA KEV catalog, the attack surface is significant because it allows access to internal services and metadata endpoints via the background synchronisation background task. The requirement for only station‑scoped RemoteRelay permission means the risk is limited to users who can modify remote relays, but the lack of host validation enables arbitrary internal requests once such permission is granted. The vulnerability remains exploitable until a patch is released; no workaround is documented at this time.