{"uuid": "f4f8b136-b622-4c04-aefd-213b2a343132", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50552", "type": "seen", "source": "https://gist.github.com/alon710/0bc2e259381309bd98ca630012fce3cb", "content": "# CVE-2026-50552: CVE-2026-50552: Server-Side Request Forgery via Validation Bypass in Koel\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-07-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-50552\n\n## Summary\nAn authenticated Server-Side Request Forgery (SSRF) vulnerability in Koel, an open-source personal music streaming server, allows remote attackers to probe internal hosts and loopback addresses. The vulnerability arises due to a missing 'bail' validation rule in the Laravel-based form validation pipeline, which permits downstream HTTP checks to execute even after a URL has failed security verification.\n\n## TL;DR\nA missing validation halt keyword allows Koel's HTTP client to initiate connection probes to internal and loopback IP addresses even after the URL is marked unsafe.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918 (Server-Side Request Forgery)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 6.3 (Medium)\n- **EPSS Score**: 0.0016\n- **EPSS Percentile**: 5.55%\n- **Exploit Status**: Proof of Concept / Public Details Available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Koel streaming servers deployed on private networks or hosting platforms.\n- **Koel**: < 9.7.1 (Fixed in: `9.7.1`)\n\n## Mitigation\n\n- Upgrade the Koel application instance to version 9.7.1 or higher to enforce proper validation termination.\n- Restrict outbound network access from the Koel application container to internal subnets (RFC 1918) and the local loopback interface.\n- Utilize Web Application Firewall (WAF) rules to detect and reject validation requests containing internal IP configurations.\n\n**Remediation Steps:**\n1. Navigate to the root directory of the Koel deployment.\n2. Pull the latest codebase updates using the repository manager: git pull origin master\n3. Re-install dependencies using Composer: composer install --no-dev\n4. Synchronize system state using the Artisan command-line tool: php artisan koel:sync\n\n## References\n\n- [GitHub Security Advisory GHSA-jr4p-4xjh-fwvw](https://github.com/koel/koel/security/advisories/GHSA-jr4p-4xjh-fwvw)\n- [Official Fix Commit](https://github.com/koel/koel/commit/5f6ce2cefd08f437a269236b677ad971517ccbb6)\n- [CVE Record Database](https://www.cve.org/CVERecord?id=CVE-2026-50552)\n- [NVD Vulnerability Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-50552)\n- [Koel Release v9.7.1](https://github.com/koel/koel/releases/tag/v9.7.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-50552) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-15T19:31:25.216249Z"}