PT-2026-31718 · Unknown · Sonicverse

Rikvisser-Dev · Published 2026-04-09 · Updated 2026-04-19 · CVE-2026-40089

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Sonicverse versions prior to commit cb1ddbacafcb441549fe87d3eeabdb6a085325e4

Description The Sonicverse Radio Audio Streaming Stack dashboard contains a Server-Side Request Forgery (SSRF) vulnerability in its API client (apps/dashboard/lib/api.ts). The dashboard accepts user-controlled URLs and passes them directly to a server-side HTTP client without sufficient validation. An authenticated operator can abuse this to make arbitrary HTTP requests from the dashboard backend to internal or external systems.

Recommendations Update to commit cb1ddbacafcb441549fe87d3eeabdb6a085325e4.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-40089

Affected Products

Sonicverse

References · 7

• 🔥 https://github.com/sonicverse-eu/audiostreaming-stack/security/advisories/GHSA-8vvj-7f7r-7v48 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-40089 · Security Note
• https://twitter.com/CVEnew/status/2042340049216270617 · Twitter Post
• https://twitter.com/giuseppe_1337/status/2045655036466786534 · Twitter Post
• https://twitter.com/ctiwatchcloud/status/2042573330209730950 · Twitter Post
• https://twitter.com/CveFindCom/status/2042342663085522990 · Twitter Post
• https://twitter.com/0dayPublishing/status/2042334156596605267 · Twitter Post