Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
14 vulnerabilities by koel
CVE-2026-54494 (GCVE-0-2026-54494)
Vulnerability from nvd – Published: 2026-08-19 20:46 – Updated: 2026-08-19 20:46
VLAI
EPSS
VEX
Title
Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4
Summary
Koel is a free, open-source music streaming solution. Prior to 9.7.1, App\Helpers\Network::isPublicHost() uses filter_var() with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE, which treats NAT64 64:ff9b::/96 and 6to4 2002::/16 wrappers of private, loopback, or link-local IPv4 addresses as public. An authenticated user can place such an address in a podcast RSS <enclosure url> and reach app/Values/Podcast/EpisodePlayable.php through EpisodePlayable::createForEpisode(), where isSafeUrl() accepts the target and Http::sink($file)->get($url) fetches it. On a host with NAT64 or 6to4 routing, Koel can request internal services or cloud metadata and return the response body to the user. This issue is fixed in version 9.7.1
Severity
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/koel/koel/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/koel/koel/pull/2549 | x_refsource_MISC |
| https://github.com/koel/koel/commit/5f6ce2cefd08f… | x_refsource_MISC |
| https://github.com/koel/koel/releases/tag/v9.7.1 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "koel",
"vendor": "koel",
"versions": [
{
"status": "affected",
"version": "\u003c 9.7.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Koel is a free, open-source music streaming solution. Prior to 9.7.1, App\\Helpers\\Network::isPublicHost() uses filter_var() with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE, which treats NAT64 64:ff9b::/96 and 6to4 2002::/16 wrappers of private, loopback, or link-local IPv4 addresses as public. An authenticated user can place such an address in a podcast RSS \u003cenclosure url\u003e and reach app/Values/Podcast/EpisodePlayable.php through EpisodePlayable::createForEpisode(), where isSafeUrl() accepts the target and Http::sink($file)-\u003eget($url) fetches it. On a host with NAT64 or 6to4 routing, Koel can request internal services or cloud metadata and return the response body to the user. This issue is fixed in version 9.7.1"
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T20:46:01.824Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/koel/koel/security/advisories/GHSA-rjg7-r26h-cfp2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/koel/koel/security/advisories/GHSA-rjg7-r26h-cfp2"
},
{
"name": "https://github.com/koel/koel/pull/2549",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/pull/2549"
},
{
"name": "https://github.com/koel/koel/commit/5f6ce2cefd08f437a269236b677ad971517ccbb6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/commit/5f6ce2cefd08f437a269236b677ad971517ccbb6"
},
{
"name": "https://github.com/koel/koel/releases/tag/v9.7.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/releases/tag/v9.7.1"
}
],
"source": {
"advisory": "GHSA-rjg7-r26h-cfp2",
"discovery": "UNKNOWN"
},
"title": "Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54494",
"datePublished": "2026-08-19T20:46:01.824Z",
"dateReserved": "2026-06-15T18:01:15.510Z",
"dateUpdated": "2026-08-19T20:46:01.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54493 (GCVE-0-2026-54493)
Vulnerability from nvd – Published: 2026-08-19 20:46 – Updated: 2026-08-19 20:46
VLAI
EPSS
VEX
Title
Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations
Summary
Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without the SafeUrl and HasAudioContentType checks used by the regular radio API. app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php and app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php pass the stored URL through app/Services/RadioService.php to app/Services/Radio/RadioStreamProxy.php, where RadioStreamProxy::openStream() calls fopen($url, 'r', false, $context). Streaming /radio/stream/{id} returns the upstream response body, allowing access to loopback, RFC1918, Docker bridge, metadata, or other internal HTTP services reachable from the Koel server. This issue is fixed in version 9.7.0.
Severity
7.7 (High)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/koel/koel/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/koel/koel/pull/2545 | x_refsource_MISC |
| https://github.com/koel/koel/commit/1331f335342b4… | x_refsource_MISC |
| https://github.com/koel/koel/releases/tag/v9.7.0 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "koel",
"vendor": "koel",
"versions": [
{
"status": "affected",
"version": "\u003c 9.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user\u0027s streamUrl without the SafeUrl and HasAudioContentType checks used by the regular radio API. app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php and app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php pass the stored URL through app/Services/RadioService.php to app/Services/Radio/RadioStreamProxy.php, where RadioStreamProxy::openStream() calls fopen($url, \u0027r\u0027, false, $context). Streaming /radio/stream/{id} returns the upstream response body, allowing access to loopback, RFC1918, Docker bridge, metadata, or other internal HTTP services reachable from the Koel server. This issue is fixed in version 9.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T20:46:50.890Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/koel/koel/security/advisories/GHSA-6p96-cfg5-4vhp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/koel/koel/security/advisories/GHSA-6p96-cfg5-4vhp"
},
{
"name": "https://github.com/koel/koel/pull/2545",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/pull/2545"
},
{
"name": "https://github.com/koel/koel/commit/1331f335342b405e60ffabdd60f1f398508f996f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/commit/1331f335342b405e60ffabdd60f1f398508f996f"
},
{
"name": "https://github.com/koel/koel/releases/tag/v9.7.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/releases/tag/v9.7.0"
}
],
"source": {
"advisory": "GHSA-6p96-cfg5-4vhp",
"discovery": "UNKNOWN"
},
"title": "Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54493",
"datePublished": "2026-08-19T20:46:50.890Z",
"dateReserved": "2026-06-15T18:01:15.510Z",
"dateUpdated": "2026-08-19T20:46:50.890Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54492 (GCVE-0-2026-54492)
Vulnerability from nvd – Published: 2026-08-19 20:44 – Updated: 2026-08-20 13:43
VLAI
EPSS
VEX
Title
Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation
Summary
Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createPodcastChannel.view route accepts an authenticated user's private URL because app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php does not apply the SafeUrl validation used by the regular podcast API. app/Http/Controllers/Subsonic/CreatePodcastChannelController.php passes the URL to app/Services/Podcast/PodcastService.php, where PodcastService::addPodcast() and createParser() invoke Poddle::fromUrl() during channel creation, causing immediate server-side requests to loopback, Docker bridge, or RFC1918 HTTP destinations. The confirmed impact is blind internal request execution because generic response-body exfiltration was not demonstrated through this route. This issue is fixed in version 9.7.0.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 13:41 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/koel/koel/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/koel/koel/pull/2545 | x_refsource_MISC |
| https://github.com/koel/koel/commit/1331f335342b4… | x_refsource_MISC |
| https://github.com/koel/koel/releases/tag/v9.7.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54492",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T13:41:13.920879Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T13:43:02.603Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/koel/koel/security/advisories/GHSA-w79m-f3jx-779v"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "koel",
"vendor": "koel",
"versions": [
{
"status": "affected",
"version": "\u003c 9.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createPodcastChannel.view route accepts an authenticated user\u0027s private URL because app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php does not apply the SafeUrl validation used by the regular podcast API. app/Http/Controllers/Subsonic/CreatePodcastChannelController.php passes the URL to app/Services/Podcast/PodcastService.php, where PodcastService::addPodcast() and createParser() invoke Poddle::fromUrl() during channel creation, causing immediate server-side requests to loopback, Docker bridge, or RFC1918 HTTP destinations. The confirmed impact is blind internal request execution because generic response-body exfiltration was not demonstrated through this route. This issue is fixed in version 9.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T20:44:33.090Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/koel/koel/security/advisories/GHSA-w79m-f3jx-779v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/koel/koel/security/advisories/GHSA-w79m-f3jx-779v"
},
{
"name": "https://github.com/koel/koel/pull/2545",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/pull/2545"
},
{
"name": "https://github.com/koel/koel/commit/1331f335342b405e60ffabdd60f1f398508f996f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/commit/1331f335342b405e60ffabdd60f1f398508f996f"
},
{
"name": "https://github.com/koel/koel/releases/tag/v9.7.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/releases/tag/v9.7.0"
}
],
"source": {
"advisory": "GHSA-w79m-f3jx-779v",
"discovery": "UNKNOWN"
},
"title": "Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54492",
"datePublished": "2026-08-19T20:44:33.090Z",
"dateReserved": "2026-06-15T18:01:15.510Z",
"dateUpdated": "2026-08-20T13:43:02.603Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54491 (GCVE-0-2026-54491)
Vulnerability from nvd – Published: 2026-08-19 20:48 – Updated: 2026-08-20 19:47
VLAI
EPSS
VEX
Title
Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths
Summary
Koel is a free, open-source music streaming solution. Prior to 9.7.1, outbound podcast and radio fetch paths perform a point-in-time App\Helpers\Network::isPublicHost() or isSafeUrl() check without pinning the validated address, and most paths lack redirect-hop validation and do not revalidate every redirect target. PhanAn\Poddle\Poddle::fromUrl(), PodcastService::getStreamableUrl(), PodcastService::isPodcastObsolete(), App\Rules\HasAudioContentType, and App\Rules\SafeUrl can therefore follow an attacker-controlled redirect to an internal address or connect after DNS rebinding changes a public resolution to a private one. These paths are reachable through podcast and radio APIs, including createPodcastChannel, createInternetRadioStation, refreshPodcasts, apiResource podcasts, and radio/stations, allowing an authenticated user to request internal services or cloud metadata and potentially receive parsed or streamed response content. This issue is fixed in version 9.7.1.
Severity
7.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 19:47 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/koel/koel/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/koel/koel/pull/2546 | x_refsource_MISC |
| https://github.com/koel/koel/pull/2549 | x_refsource_MISC |
| https://github.com/koel/koel/commit/5f6ce2cefd08f… | x_refsource_MISC |
| https://github.com/koel/koel/commit/c264a3d52513a… | x_refsource_MISC |
| https://github.com/koel/koel/releases/tag/v9.7.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54491",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T19:47:20.594827Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T19:47:26.429Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/koel/koel/security/advisories/GHSA-6qvr-wjmv-v8mm"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "koel",
"vendor": "koel",
"versions": [
{
"status": "affected",
"version": "\u003c 9.7.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Koel is a free, open-source music streaming solution. Prior to 9.7.1, outbound podcast and radio fetch paths perform a point-in-time App\\Helpers\\Network::isPublicHost() or isSafeUrl() check without pinning the validated address, and most paths lack redirect-hop validation and do not revalidate every redirect target. PhanAn\\Poddle\\Poddle::fromUrl(), PodcastService::getStreamableUrl(), PodcastService::isPodcastObsolete(), App\\Rules\\HasAudioContentType, and App\\Rules\\SafeUrl can therefore follow an attacker-controlled redirect to an internal address or connect after DNS rebinding changes a public resolution to a private one. These paths are reachable through podcast and radio APIs, including createPodcastChannel, createInternetRadioStation, refreshPodcasts, apiResource podcasts, and radio/stations, allowing an authenticated user to request internal services or cloud metadata and potentially receive parsed or streamed response content. This issue is fixed in version 9.7.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T20:48:12.951Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/koel/koel/security/advisories/GHSA-6qvr-wjmv-v8mm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/koel/koel/security/advisories/GHSA-6qvr-wjmv-v8mm"
},
{
"name": "https://github.com/koel/koel/pull/2546",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/pull/2546"
},
{
"name": "https://github.com/koel/koel/pull/2549",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/pull/2549"
},
{
"name": "https://github.com/koel/koel/commit/5f6ce2cefd08f437a269236b677ad971517ccbb6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/commit/5f6ce2cefd08f437a269236b677ad971517ccbb6"
},
{
"name": "https://github.com/koel/koel/commit/c264a3d52513a83b21e1cc3a20e895caea97fc4a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/commit/c264a3d52513a83b21e1cc3a20e895caea97fc4a"
},
{
"name": "https://github.com/koel/koel/releases/tag/v9.7.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/releases/tag/v9.7.1"
}
],
"source": {
"advisory": "GHSA-6qvr-wjmv-v8mm",
"discovery": "UNKNOWN"
},
"title": "Koel: Incomplete fix for CVE-2026-47260 \u2014 systemic SSRF in podcast \u0026 radio fetch paths"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54491",
"datePublished": "2026-08-19T20:48:12.951Z",
"dateReserved": "2026-06-15T18:01:15.510Z",
"dateUpdated": "2026-08-20T19:47:26.429Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50552 (GCVE-0-2026-50552)
Vulnerability from nvd – Published: 2026-06-12 18:51 – Updated: 2026-06-15 15:25
VLAI
EPSS
VEX
Title
Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail
Summary
Koel is a free, open-source music streaming solution. Prior to version 9.7.1, Koel contains a Server-Side Request Forgery (SSRF) vulnerability in the radio station creation endpoint (POST /api/radio/stations). The url field validation rules are declared without the bail keyword, so the HasAudioContentType rule — which issues HTTP requests to the supplied URL — still executes even after the SafeUrl rule has rejected the URL as pointing to a private/reserved address. Any authenticated, non-admin user can therefore coerce the server into making HEAD/GET requests to arbitrary internal hosts. This issue has been patched in version 9.7.1.
Severity
6.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-15 15:25 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/koel/koel/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/koel/koel/commit/5f6ce2cefd08f… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50552",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T15:25:19.610002Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-15T15:25:23.537Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/koel/koel/security/advisories/GHSA-jr4p-4xjh-fwvw"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "koel",
"vendor": "koel",
"versions": [
{
"status": "affected",
"version": "\u003c 9.7.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Koel is a free, open-source music streaming solution. Prior to version 9.7.1, Koel contains a Server-Side Request Forgery (SSRF) vulnerability in the radio station creation endpoint (POST /api/radio/stations). The url field validation rules are declared without the bail keyword, so the HasAudioContentType rule \u2014 which issues HTTP requests to the supplied URL \u2014 still executes even after the SafeUrl rule has rejected the URL as pointing to a private/reserved address. Any authenticated, non-admin user can therefore coerce the server into making HEAD/GET requests to arbitrary internal hosts. This issue has been patched in version 9.7.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T18:51:46.028Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/koel/koel/security/advisories/GHSA-jr4p-4xjh-fwvw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/koel/koel/security/advisories/GHSA-jr4p-4xjh-fwvw"
},
{
"name": "https://github.com/koel/koel/commit/5f6ce2cefd08f437a269236b677ad971517ccbb6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/commit/5f6ce2cefd08f437a269236b677ad971517ccbb6"
}
],
"source": {
"advisory": "GHSA-jr4p-4xjh-fwvw",
"discovery": "UNKNOWN"
},
"title": "Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50552",
"datePublished": "2026-06-12T18:51:46.028Z",
"dateReserved": "2026-06-04T20:37:18.654Z",
"dateUpdated": "2026-06-15T15:25:23.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47260 (GCVE-0-2026-47260)
Vulnerability from nvd – Published: 2026-06-12 18:50 – Updated: 2026-06-13 03:28
VLAI
EPSS
VEX
Title
Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs
Summary
Koel is a free, open-source music streaming solution. Prior to version 9.3.5, Koel validates the podcast feed URL via the SafeUrl rule (DNS resolution + public IP check), but the individual episode <enclosure url="..."> values extracted from the RSS XML are stored directly into the database without any SSRF validation. When a user plays an episode, the server downloads the full HTTP response from the unvalidated enclosure URL via Http::sink()->get() and streams it back to the user, enabling full-read SSRF against internal services. This issue has been patched in version 9.3.5.
Severity
7.7 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-13 03:28 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/koel/koel/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/koel/koel/commit/8708f077efd7d… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47260",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-13T03:28:00.636910Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-13T03:28:32.095Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/koel/koel/security/advisories/GHSA-7j2f-6h2r-6cqc"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "koel",
"vendor": "koel",
"versions": [
{
"status": "affected",
"version": "\u003c 9.3.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Koel is a free, open-source music streaming solution. Prior to version 9.3.5, Koel validates the podcast feed URL via the SafeUrl rule (DNS resolution + public IP check), but the individual episode \u003cenclosure url=\"...\"\u003e values extracted from the RSS XML are stored directly into the database without any SSRF validation. When a user plays an episode, the server downloads the full HTTP response from the unvalidated enclosure URL via Http::sink()-\u003eget() and streams it back to the user, enabling full-read SSRF against internal services. This issue has been patched in version 9.3.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T18:50:42.766Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/koel/koel/security/advisories/GHSA-7j2f-6h2r-6cqc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/koel/koel/security/advisories/GHSA-7j2f-6h2r-6cqc"
},
{
"name": "https://github.com/koel/koel/commit/8708f077efd7d8a332b32e954d65bc837f3a413a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/commit/8708f077efd7d8a332b32e954d65bc837f3a413a"
}
],
"source": {
"advisory": "GHSA-7j2f-6h2r-6cqc",
"discovery": "UNKNOWN"
},
"title": "Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47260",
"datePublished": "2026-06-12T18:50:42.766Z",
"dateReserved": "2026-05-18T23:03:37.229Z",
"dateUpdated": "2026-06-13T03:28:32.095Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-33563 (GCVE-0-2021-33563)
Vulnerability from nvd – Published: 2021-05-24 22:45 – Updated: 2024-08-03 23:50
VLAI
EPSS
VEX
Summary
Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. This might make brute-force attacks easier.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://huntr.dev/bounties/1-other-koel/koel/ | x_refsource_MISC |
| https://github.com/koel/koel/releases/tag/v5.1.4 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:43.146Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://huntr.dev/bounties/1-other-koel/koel/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/koel/koel/releases/tag/v5.1.4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. This might make brute-force attacks easier."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-24T22:45:08.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://huntr.dev/bounties/1-other-koel/koel/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/releases/tag/v5.1.4"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33563",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. This might make brute-force attacks easier."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://huntr.dev/bounties/1-other-koel/koel/",
"refsource": "MISC",
"url": "https://huntr.dev/bounties/1-other-koel/koel/"
},
{
"name": "https://github.com/koel/koel/releases/tag/v5.1.4",
"refsource": "MISC",
"url": "https://github.com/koel/koel/releases/tag/v5.1.4"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33563",
"datePublished": "2021-05-24T22:45:08.000Z",
"dateReserved": "2021-05-24T00:00:00.000Z",
"dateUpdated": "2024-08-03T23:50:43.146Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-54491 (GCVE-0-2026-54491)
Vulnerability from cvelistv5 – Published: 2026-08-19 20:48 – Updated: 2026-08-20 19:47
VLAI
EPSS
VEX
Title
Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths
Summary
Koel is a free, open-source music streaming solution. Prior to 9.7.1, outbound podcast and radio fetch paths perform a point-in-time App\Helpers\Network::isPublicHost() or isSafeUrl() check without pinning the validated address, and most paths lack redirect-hop validation and do not revalidate every redirect target. PhanAn\Poddle\Poddle::fromUrl(), PodcastService::getStreamableUrl(), PodcastService::isPodcastObsolete(), App\Rules\HasAudioContentType, and App\Rules\SafeUrl can therefore follow an attacker-controlled redirect to an internal address or connect after DNS rebinding changes a public resolution to a private one. These paths are reachable through podcast and radio APIs, including createPodcastChannel, createInternetRadioStation, refreshPodcasts, apiResource podcasts, and radio/stations, allowing an authenticated user to request internal services or cloud metadata and potentially receive parsed or streamed response content. This issue is fixed in version 9.7.1.
Severity
7.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 19:47 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/koel/koel/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/koel/koel/pull/2546 | x_refsource_MISC |
| https://github.com/koel/koel/pull/2549 | x_refsource_MISC |
| https://github.com/koel/koel/commit/5f6ce2cefd08f… | x_refsource_MISC |
| https://github.com/koel/koel/commit/c264a3d52513a… | x_refsource_MISC |
| https://github.com/koel/koel/releases/tag/v9.7.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54491",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T19:47:20.594827Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T19:47:26.429Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/koel/koel/security/advisories/GHSA-6qvr-wjmv-v8mm"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "koel",
"vendor": "koel",
"versions": [
{
"status": "affected",
"version": "\u003c 9.7.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Koel is a free, open-source music streaming solution. Prior to 9.7.1, outbound podcast and radio fetch paths perform a point-in-time App\\Helpers\\Network::isPublicHost() or isSafeUrl() check without pinning the validated address, and most paths lack redirect-hop validation and do not revalidate every redirect target. PhanAn\\Poddle\\Poddle::fromUrl(), PodcastService::getStreamableUrl(), PodcastService::isPodcastObsolete(), App\\Rules\\HasAudioContentType, and App\\Rules\\SafeUrl can therefore follow an attacker-controlled redirect to an internal address or connect after DNS rebinding changes a public resolution to a private one. These paths are reachable through podcast and radio APIs, including createPodcastChannel, createInternetRadioStation, refreshPodcasts, apiResource podcasts, and radio/stations, allowing an authenticated user to request internal services or cloud metadata and potentially receive parsed or streamed response content. This issue is fixed in version 9.7.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T20:48:12.951Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/koel/koel/security/advisories/GHSA-6qvr-wjmv-v8mm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/koel/koel/security/advisories/GHSA-6qvr-wjmv-v8mm"
},
{
"name": "https://github.com/koel/koel/pull/2546",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/pull/2546"
},
{
"name": "https://github.com/koel/koel/pull/2549",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/pull/2549"
},
{
"name": "https://github.com/koel/koel/commit/5f6ce2cefd08f437a269236b677ad971517ccbb6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/commit/5f6ce2cefd08f437a269236b677ad971517ccbb6"
},
{
"name": "https://github.com/koel/koel/commit/c264a3d52513a83b21e1cc3a20e895caea97fc4a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/commit/c264a3d52513a83b21e1cc3a20e895caea97fc4a"
},
{
"name": "https://github.com/koel/koel/releases/tag/v9.7.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/releases/tag/v9.7.1"
}
],
"source": {
"advisory": "GHSA-6qvr-wjmv-v8mm",
"discovery": "UNKNOWN"
},
"title": "Koel: Incomplete fix for CVE-2026-47260 \u2014 systemic SSRF in podcast \u0026 radio fetch paths"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54491",
"datePublished": "2026-08-19T20:48:12.951Z",
"dateReserved": "2026-06-15T18:01:15.510Z",
"dateUpdated": "2026-08-20T19:47:26.429Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54493 (GCVE-0-2026-54493)
Vulnerability from cvelistv5 – Published: 2026-08-19 20:46 – Updated: 2026-08-19 20:46
VLAI
EPSS
VEX
Title
Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations
Summary
Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without the SafeUrl and HasAudioContentType checks used by the regular radio API. app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php and app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php pass the stored URL through app/Services/RadioService.php to app/Services/Radio/RadioStreamProxy.php, where RadioStreamProxy::openStream() calls fopen($url, 'r', false, $context). Streaming /radio/stream/{id} returns the upstream response body, allowing access to loopback, RFC1918, Docker bridge, metadata, or other internal HTTP services reachable from the Koel server. This issue is fixed in version 9.7.0.
Severity
7.7 (High)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/koel/koel/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/koel/koel/pull/2545 | x_refsource_MISC |
| https://github.com/koel/koel/commit/1331f335342b4… | x_refsource_MISC |
| https://github.com/koel/koel/releases/tag/v9.7.0 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "koel",
"vendor": "koel",
"versions": [
{
"status": "affected",
"version": "\u003c 9.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user\u0027s streamUrl without the SafeUrl and HasAudioContentType checks used by the regular radio API. app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php and app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php pass the stored URL through app/Services/RadioService.php to app/Services/Radio/RadioStreamProxy.php, where RadioStreamProxy::openStream() calls fopen($url, \u0027r\u0027, false, $context). Streaming /radio/stream/{id} returns the upstream response body, allowing access to loopback, RFC1918, Docker bridge, metadata, or other internal HTTP services reachable from the Koel server. This issue is fixed in version 9.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T20:46:50.890Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/koel/koel/security/advisories/GHSA-6p96-cfg5-4vhp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/koel/koel/security/advisories/GHSA-6p96-cfg5-4vhp"
},
{
"name": "https://github.com/koel/koel/pull/2545",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/pull/2545"
},
{
"name": "https://github.com/koel/koel/commit/1331f335342b405e60ffabdd60f1f398508f996f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/commit/1331f335342b405e60ffabdd60f1f398508f996f"
},
{
"name": "https://github.com/koel/koel/releases/tag/v9.7.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/releases/tag/v9.7.0"
}
],
"source": {
"advisory": "GHSA-6p96-cfg5-4vhp",
"discovery": "UNKNOWN"
},
"title": "Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54493",
"datePublished": "2026-08-19T20:46:50.890Z",
"dateReserved": "2026-06-15T18:01:15.510Z",
"dateUpdated": "2026-08-19T20:46:50.890Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54494 (GCVE-0-2026-54494)
Vulnerability from cvelistv5 – Published: 2026-08-19 20:46 – Updated: 2026-08-19 20:46
VLAI
EPSS
VEX
Title
Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4
Summary
Koel is a free, open-source music streaming solution. Prior to 9.7.1, App\Helpers\Network::isPublicHost() uses filter_var() with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE, which treats NAT64 64:ff9b::/96 and 6to4 2002::/16 wrappers of private, loopback, or link-local IPv4 addresses as public. An authenticated user can place such an address in a podcast RSS <enclosure url> and reach app/Values/Podcast/EpisodePlayable.php through EpisodePlayable::createForEpisode(), where isSafeUrl() accepts the target and Http::sink($file)->get($url) fetches it. On a host with NAT64 or 6to4 routing, Koel can request internal services or cloud metadata and return the response body to the user. This issue is fixed in version 9.7.1
Severity
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/koel/koel/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/koel/koel/pull/2549 | x_refsource_MISC |
| https://github.com/koel/koel/commit/5f6ce2cefd08f… | x_refsource_MISC |
| https://github.com/koel/koel/releases/tag/v9.7.1 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "koel",
"vendor": "koel",
"versions": [
{
"status": "affected",
"version": "\u003c 9.7.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Koel is a free, open-source music streaming solution. Prior to 9.7.1, App\\Helpers\\Network::isPublicHost() uses filter_var() with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE, which treats NAT64 64:ff9b::/96 and 6to4 2002::/16 wrappers of private, loopback, or link-local IPv4 addresses as public. An authenticated user can place such an address in a podcast RSS \u003cenclosure url\u003e and reach app/Values/Podcast/EpisodePlayable.php through EpisodePlayable::createForEpisode(), where isSafeUrl() accepts the target and Http::sink($file)-\u003eget($url) fetches it. On a host with NAT64 or 6to4 routing, Koel can request internal services or cloud metadata and return the response body to the user. This issue is fixed in version 9.7.1"
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T20:46:01.824Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/koel/koel/security/advisories/GHSA-rjg7-r26h-cfp2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/koel/koel/security/advisories/GHSA-rjg7-r26h-cfp2"
},
{
"name": "https://github.com/koel/koel/pull/2549",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/pull/2549"
},
{
"name": "https://github.com/koel/koel/commit/5f6ce2cefd08f437a269236b677ad971517ccbb6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/commit/5f6ce2cefd08f437a269236b677ad971517ccbb6"
},
{
"name": "https://github.com/koel/koel/releases/tag/v9.7.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/releases/tag/v9.7.1"
}
],
"source": {
"advisory": "GHSA-rjg7-r26h-cfp2",
"discovery": "UNKNOWN"
},
"title": "Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54494",
"datePublished": "2026-08-19T20:46:01.824Z",
"dateReserved": "2026-06-15T18:01:15.510Z",
"dateUpdated": "2026-08-19T20:46:01.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54492 (GCVE-0-2026-54492)
Vulnerability from cvelistv5 – Published: 2026-08-19 20:44 – Updated: 2026-08-20 13:43
VLAI
EPSS
VEX
Title
Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation
Summary
Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createPodcastChannel.view route accepts an authenticated user's private URL because app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php does not apply the SafeUrl validation used by the regular podcast API. app/Http/Controllers/Subsonic/CreatePodcastChannelController.php passes the URL to app/Services/Podcast/PodcastService.php, where PodcastService::addPodcast() and createParser() invoke Poddle::fromUrl() during channel creation, causing immediate server-side requests to loopback, Docker bridge, or RFC1918 HTTP destinations. The confirmed impact is blind internal request execution because generic response-body exfiltration was not demonstrated through this route. This issue is fixed in version 9.7.0.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 13:41 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/koel/koel/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/koel/koel/pull/2545 | x_refsource_MISC |
| https://github.com/koel/koel/commit/1331f335342b4… | x_refsource_MISC |
| https://github.com/koel/koel/releases/tag/v9.7.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54492",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T13:41:13.920879Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T13:43:02.603Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/koel/koel/security/advisories/GHSA-w79m-f3jx-779v"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "koel",
"vendor": "koel",
"versions": [
{
"status": "affected",
"version": "\u003c 9.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createPodcastChannel.view route accepts an authenticated user\u0027s private URL because app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php does not apply the SafeUrl validation used by the regular podcast API. app/Http/Controllers/Subsonic/CreatePodcastChannelController.php passes the URL to app/Services/Podcast/PodcastService.php, where PodcastService::addPodcast() and createParser() invoke Poddle::fromUrl() during channel creation, causing immediate server-side requests to loopback, Docker bridge, or RFC1918 HTTP destinations. The confirmed impact is blind internal request execution because generic response-body exfiltration was not demonstrated through this route. This issue is fixed in version 9.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T20:44:33.090Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/koel/koel/security/advisories/GHSA-w79m-f3jx-779v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/koel/koel/security/advisories/GHSA-w79m-f3jx-779v"
},
{
"name": "https://github.com/koel/koel/pull/2545",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/pull/2545"
},
{
"name": "https://github.com/koel/koel/commit/1331f335342b405e60ffabdd60f1f398508f996f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/commit/1331f335342b405e60ffabdd60f1f398508f996f"
},
{
"name": "https://github.com/koel/koel/releases/tag/v9.7.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/releases/tag/v9.7.0"
}
],
"source": {
"advisory": "GHSA-w79m-f3jx-779v",
"discovery": "UNKNOWN"
},
"title": "Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54492",
"datePublished": "2026-08-19T20:44:33.090Z",
"dateReserved": "2026-06-15T18:01:15.510Z",
"dateUpdated": "2026-08-20T13:43:02.603Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50552 (GCVE-0-2026-50552)
Vulnerability from cvelistv5 – Published: 2026-06-12 18:51 – Updated: 2026-06-15 15:25
VLAI
EPSS
VEX
Title
Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail
Summary
Koel is a free, open-source music streaming solution. Prior to version 9.7.1, Koel contains a Server-Side Request Forgery (SSRF) vulnerability in the radio station creation endpoint (POST /api/radio/stations). The url field validation rules are declared without the bail keyword, so the HasAudioContentType rule — which issues HTTP requests to the supplied URL — still executes even after the SafeUrl rule has rejected the URL as pointing to a private/reserved address. Any authenticated, non-admin user can therefore coerce the server into making HEAD/GET requests to arbitrary internal hosts. This issue has been patched in version 9.7.1.
Severity
6.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-15 15:25 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/koel/koel/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/koel/koel/commit/5f6ce2cefd08f… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50552",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T15:25:19.610002Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-15T15:25:23.537Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/koel/koel/security/advisories/GHSA-jr4p-4xjh-fwvw"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "koel",
"vendor": "koel",
"versions": [
{
"status": "affected",
"version": "\u003c 9.7.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Koel is a free, open-source music streaming solution. Prior to version 9.7.1, Koel contains a Server-Side Request Forgery (SSRF) vulnerability in the radio station creation endpoint (POST /api/radio/stations). The url field validation rules are declared without the bail keyword, so the HasAudioContentType rule \u2014 which issues HTTP requests to the supplied URL \u2014 still executes even after the SafeUrl rule has rejected the URL as pointing to a private/reserved address. Any authenticated, non-admin user can therefore coerce the server into making HEAD/GET requests to arbitrary internal hosts. This issue has been patched in version 9.7.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T18:51:46.028Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/koel/koel/security/advisories/GHSA-jr4p-4xjh-fwvw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/koel/koel/security/advisories/GHSA-jr4p-4xjh-fwvw"
},
{
"name": "https://github.com/koel/koel/commit/5f6ce2cefd08f437a269236b677ad971517ccbb6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/commit/5f6ce2cefd08f437a269236b677ad971517ccbb6"
}
],
"source": {
"advisory": "GHSA-jr4p-4xjh-fwvw",
"discovery": "UNKNOWN"
},
"title": "Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50552",
"datePublished": "2026-06-12T18:51:46.028Z",
"dateReserved": "2026-06-04T20:37:18.654Z",
"dateUpdated": "2026-06-15T15:25:23.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47260 (GCVE-0-2026-47260)
Vulnerability from cvelistv5 – Published: 2026-06-12 18:50 – Updated: 2026-06-13 03:28
VLAI
EPSS
VEX
Title
Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs
Summary
Koel is a free, open-source music streaming solution. Prior to version 9.3.5, Koel validates the podcast feed URL via the SafeUrl rule (DNS resolution + public IP check), but the individual episode <enclosure url="..."> values extracted from the RSS XML are stored directly into the database without any SSRF validation. When a user plays an episode, the server downloads the full HTTP response from the unvalidated enclosure URL via Http::sink()->get() and streams it back to the user, enabling full-read SSRF against internal services. This issue has been patched in version 9.3.5.
Severity
7.7 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-13 03:28 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/koel/koel/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/koel/koel/commit/8708f077efd7d… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47260",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-13T03:28:00.636910Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-13T03:28:32.095Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/koel/koel/security/advisories/GHSA-7j2f-6h2r-6cqc"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "koel",
"vendor": "koel",
"versions": [
{
"status": "affected",
"version": "\u003c 9.3.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Koel is a free, open-source music streaming solution. Prior to version 9.3.5, Koel validates the podcast feed URL via the SafeUrl rule (DNS resolution + public IP check), but the individual episode \u003cenclosure url=\"...\"\u003e values extracted from the RSS XML are stored directly into the database without any SSRF validation. When a user plays an episode, the server downloads the full HTTP response from the unvalidated enclosure URL via Http::sink()-\u003eget() and streams it back to the user, enabling full-read SSRF against internal services. This issue has been patched in version 9.3.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T18:50:42.766Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/koel/koel/security/advisories/GHSA-7j2f-6h2r-6cqc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/koel/koel/security/advisories/GHSA-7j2f-6h2r-6cqc"
},
{
"name": "https://github.com/koel/koel/commit/8708f077efd7d8a332b32e954d65bc837f3a413a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/commit/8708f077efd7d8a332b32e954d65bc837f3a413a"
}
],
"source": {
"advisory": "GHSA-7j2f-6h2r-6cqc",
"discovery": "UNKNOWN"
},
"title": "Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47260",
"datePublished": "2026-06-12T18:50:42.766Z",
"dateReserved": "2026-05-18T23:03:37.229Z",
"dateUpdated": "2026-06-13T03:28:32.095Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-33563 (GCVE-0-2021-33563)
Vulnerability from cvelistv5 – Published: 2021-05-24 22:45 – Updated: 2024-08-03 23:50
VLAI
EPSS
VEX
Summary
Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. This might make brute-force attacks easier.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://huntr.dev/bounties/1-other-koel/koel/ | x_refsource_MISC |
| https://github.com/koel/koel/releases/tag/v5.1.4 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:43.146Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://huntr.dev/bounties/1-other-koel/koel/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/koel/koel/releases/tag/v5.1.4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. This might make brute-force attacks easier."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-24T22:45:08.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://huntr.dev/bounties/1-other-koel/koel/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/koel/koel/releases/tag/v5.1.4"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33563",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. This might make brute-force attacks easier."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://huntr.dev/bounties/1-other-koel/koel/",
"refsource": "MISC",
"url": "https://huntr.dev/bounties/1-other-koel/koel/"
},
{
"name": "https://github.com/koel/koel/releases/tag/v5.1.4",
"refsource": "MISC",
"url": "https://github.com/koel/koel/releases/tag/v5.1.4"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33563",
"datePublished": "2021-05-24T22:45:08.000Z",
"dateReserved": "2021-05-24T00:00:00.000Z",
"dateUpdated": "2024-08-03T23:50:43.146Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}