TI-2026-39339 CVE-2026-54493 · GHSA-6p96-cfg5-4vhp
Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations
Priority HIGH 67
Koel is a free, open-source music streaming solution.
koel
Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
koel records in CISA KEVNo koel vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
7 records
TI-2026-34840 CVE-2026-47260 · GHSA-7j2f-6h2r-6cqc
Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs
Priority HIGH 67
Koel is a free, open-source music streaming solution.
TI-2026-39337 CVE-2026-54491 · GHSA-6qvr-wjmv-v8mm
Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths
Priority MEDIUM 64
Koel is a free, open-source music streaming solution.
TI-2026-39340 CVE-2026-54494 · GHSA-rjg7-r26h-cfp2
Server-side request forgery in koel
Priority MEDIUM 63
Koel is a free, open-source music streaming solution.
TI-2026-37274 CVE-2026-50552 · GHSA-jr4p-4xjh-fwvw
Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail
Priority MEDIUM 61
Koel is a free, open-source music streaming solution.
TI-2026-39338 CVE-2026-54492 · GHSA-w79m-f3jx-779v
Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation
Priority MEDIUM 53
Koel is a free, open-source music streaming solution.
TI-2021-12956 CVE-2021-33563 · GHSA-r37h-j483-cjjm
Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows…
Priority LOW 34
Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username.