CVE-2026-100849 | AzuraCast up to 0.23.7 Webhook URL Validation AbstractConnector.php getValidUrl server-side request forgery

September 27, 2026 Yanac

A vulnerability was found in AzuraCast up to 0.23.7. It has been declared as critical. The impacted element is the function AbstractConnector::getValidUrl of the file backend/src/Webhook/Connector/AbstractConnector.php of the component Webhook URL Validation. Such manipulation leads to server-side request forgery.

This vulnerability is referenced as CVE-2026-100849. It is possible to launch the attack remotely. No exploit is available.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More