Skip to content
Threat Feed
Subscribe

Product

Koel (<= 9.6.0)

1 brief RSS
high advisory

Koel Authenticated Full-Read SSRF via Subsonic Internet Radio Stations

An authenticated user can exploit a Server-Side Request Forgery (SSRF) vulnerability, CVE-2026-54493, in Koel v9.6.0 via the Subsonic-compatible radio endpoints, which lack proper URL validation, allowing the server to fetch and return the body of internal network resources.

Koel ssrf web-application vulnerability subsonic
1r 2t