{"id":29851,"date":"2026-09-27T12:32:30","date_gmt":"2026-09-27T04:32:30","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-100848"},"modified":"2026-09-27T12:32:30","modified_gmt":"2026-09-27T04:32:30","slug":"cve-2026-100848","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-100848","title":{"rendered":"CVE-2026-100848 [HIGH] &#8211; AzuraCast (Composer package azuracast\/azuracast) before 0.23.8 validates a station&#8217;s &#8220;Remo"},"content":{"rendered":"<p>AzuraCast (Composer package azuracast\/azuracast) before 0.23.8 validates a station&#8217;s &#8220;Remote Relay&#8221; URL only for URL syntax and an http\/https scheme (UtilitiesUrls::parseUserUrl, used by StationRemote::getUrlAsUri) and performs no host or IP address restriction. A user holding only the station-scoped RemoteRelays permission can therefore set a Remote Relay URL pointing at loopback, private-network, or cloud-metadata addresses (e.g. http:\/\/127.0.0.1:\/ or http:\/\/169.254.169.254\/latest\/meta-data\/), and AzuraCast&#8217;s periodic background Now Playing sync (AbstractRemote::getNowPlayingAsync) will automatically and repeatedly issue HTTP requests to that address, resulting in server-side request forgery against internal resources. This affects the main branch as of commit bcf8754eef3a268ad82c3db4d81f7920c3c28b56 (2026-07-31); no patched version is available at the time of the advisory.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>AzuraCast (Composer package azuracast\/azuracast) before 0.23.8 validates a station&#8217;s &#8220;Remote Relay&#8221; URL only for URL syntax and an http\/https scheme (UtilitiesUrls::parseUserUrl, used by StationRemot<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29851","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29851","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29851"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29851"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29851"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}