Sonicverse has Server-Side Request Forgery via user-controlled URLs in dashboard API client

Description

A vulnerability was found in sonicverse-eu audiostreaming-stack. It has been classified as critical. This affects an unknown function in the library apps/dashboard/lib/api.ts of the component Dashboard. This manipulation causes server-side request forgery. This vulnerability appears as CVE-2026-40089. The attack may be initiated remotely.

Affected Products

Vendor	Product	Versions
sonicverse-eu	audiostreaming-stack	< cb1ddbacafcb441549fe87d3eeabdb6a085325e4

References

https://github.com/sonicverse-eu/audiostreaming-stack/security/advisories/GHSA-8vvj-7f7r-7v48(x_refsource_CONFIRM)

Related News (1 articles)

Tier C

VulDB3h ago

CVE-2026-40089 | sonicverse-eu audiostreaming-stack Dashboard api.ts server-side request forgery

→ No new info (linked only)

CVSS 3.19.9 CRITICAL

VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

CISA KEV❌ No

Actively exploited❌ No

CWECWE-918, CWE-20

PublishedApr 9, 2026

Last enriched2h agov2

Trending Score30

Source articles1

Independent1

Info Completeness8/14

Missing: epss, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

Version History

Last enriched 2h ago

v2Tier C2h ago

Updated description with additional details and confirmed no exploit is available.

descriptioncweIds

via VulDB

v13h ago

Initial creation