Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: AzuraCast 0.23.6 Clear all filters
TI-2026-64994 CVE-2026-100856 · GHSA-mvfp-2r94-2mw9

AzuraCast before 0.23.6 Code Injection via Remote Relay Password

Priority HIGH 73

AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00468 Published 2026-09-27 Fixed in 0.23.6 CWE-94
TI-2026-64993 CVE-2026-100855 · GHSA-rwfr-jcqg-x7jc

AzuraCast before 0.23.6 Missing Permission Check via /play

Priority MEDIUM 64

AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/{station_id}/file/{id}/play endpoint that allows authenticated users to download media files from any station.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00209 Published 2026-09-27 Fixed in 0.23.6 CWE-862
TI-2026-64992 CVE-2026-100854 · GHSA-m6mg-63cr-44jj

AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API

Priority MEDIUM 57

AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00195 Published 2026-09-27 Fixed in 0.23.6 CWE-862