CVE-2026-40089

critical · 9.9

Sonicverse is a Self-hosted Docker Compose stack for live radio streaming. The Sonicverse Radio Audio Streaming Stack dashboard contains a Server-Side Request Forgery (SSRF) vulnerability in its API client (apps/dashboard/lib/api.ts). Installations created using the provided install.sh script (including the one‑liner bash <(curl -fsSL https://sonicverse.short.gy/install-audiostack)) are affected. In these deployments, the dashboard accepts user-controlled URLs and passes them directly to a server-side HTTP client without sufficient validation. An authenticated operator can abuse this to make arbitrary HTTP requests from the dashboard backend to internal or external systems. This vulnerability is fixed with commit cb1ddbacafcb441549fe87d3eeabdb6a085325e4.

9.9

CVSS

0.2%

EPSS (exploit prob.)

14th

EPSS percentile

2026-04-09

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Weaknesses

CWE-918

Affected products

Vendor	Product	Affected versions
sonicverse	radio_audio_streaming_stack	< 1.7.2

Check a specific version with /api/v1/cve/match.

References

https://github.com/sonicverse-eu/audiostreaming-stack/security/advisories/GHSA-8vvj-7f7r-7v48

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-40089