Koel allows an authenticated, non‑admin user to submit any URL when creating a radio station. Because the validation rule that should reject private or reserved addresses does not stop the subsequent HTTP request rule, the server will perform HEAD/GET calls to that URL. This lets an attacker force the server to contact arbitrary internal hosts, potentially exposing internal services or data.

The vulnerability exists in Koel, the open‑source music streaming solution, in all releases prior to version 9.7.1. The affected product is Koel (koel:koel).

The CVSS score is 6.3, indicating moderate severity, and the EPSS score is less than 1 %, showing a low likelihood of exploitation. The issue is not listed in the CISA KEV catalog. An attacker who can log in as a regular user can exploit the endpoint to probe internal network hosts. The lack of a bail keyword in the validation chain is the direct cause of the weakness.