Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-100854

AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and disclose filesystem paths.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

AzuraCast AzuraCast

Default version status: unaffected

  • 0 to < 0.23.6affected
  • 0.23.6unaffected
pkg:composer/azuracast/azuracast

References