AzuraCast before 0.23.8 contains a flaw in the webhook URL validation that allows a low‑privileged user to craft URLs pointing to internal, loopback, or private‑network addresses. Triggering the webhook endpoint causes the server to send an outbound HTTP POST with Now‑Playing data, giving the attacker the ability to contact internal resources or exfiltrate sensitive information. The weakness is an SSRF filter bypass identified as CWE‑918.

The vulnerability is limited to AzuraCast, the self‑hosted radio management suite by AzuraCast. All installations running any version prior to 0.23.8 are potentially affected. No specific sub‑versions are listed beyond the 0.23.8 release.

The CVSS score of 7.1 indicates a medium‑to‑high severity risk. EPSS is not available, so the likelihood of exploitation in the wild is currently uncertain, and the issue is not listed in CISA’s KEV catalog. The attack requires a user with the station‑scoped WebHooks permission; the user can invoke the vulnerability through the PUT /station/{id}/webhook/{id}/test endpoint, which forces the server to make the outbound request outright. Thus the threat surface is that of a low‑privilege user with authenticated access to a station who can redirect traffic to internal systems or leak data.