AzuraCast before 0.24.0 is vulnerable to SSRF via webhook connectors that allow bypassing the UserUrlFilter guard using URL redirects. Attackers who can configure webhook URLs can redirect the Guzzle client to internal services, causing responses to be logged and exposed through test logs. The vulnerability permits internal network enumeration and potential data leakage.

All installations of AzuraCast version earlier than 0.24.0 are affected, regardless of environment or deployment size.

The CVSS score of 7.1 marks this as a high‑risk vulnerability, and although the EPSS score is not available, the risk is still significant because the exploit requires only permission to manage station webhooks. The KEV catalog does not list this issue, but the ability to reach internal services poses a serious threat to confidentiality. Attackers could exploit this by directing webhook redirects to internal URLs to recover sensitive data, so strong mitigation is warranted.