Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Release: AzuraCast 0.23.8 Clear all filters
TI-2026-64991 CVE-2026-100853 · GHSA-j79h-v95g-w786

AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass

Priority HIGH 69

In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00315 Published 2026-09-27 Fixed in 0.23.8 CWE-862
TI-2026-64990 CVE-2026-100852 · GHSA-cj27-w6j8-3fpw

AzuraCast before 0.23.8 Command Injection via Streamer Username

Priority HIGH 73

AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.04647 Published 2026-09-27 Fixed in 0.23.8 CWE-78
TI-2026-64989 CVE-2026-100851 · GHSA-6mwx-gw6f-5f36

AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile

Priority HIGH 65

AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast ad…

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00256 Published 2026-09-27 Fixed in 0.23.8 CWE-200
TI-2026-64988 CVE-2026-100850 · GHSA-r4xq-h58x-54m9

AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist

Priority MEDIUM 55

AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlist fetch (backend/src/Radio/AutoDJ/QueueBuilder.php, getMediaFromRemoteUrl()).

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.0029 Published 2026-09-27 Fixed in 0.23.8 CWE-918
TI-2026-64986 CVE-2026-100848 · GHSA-xrr6-hwgm-2r77

AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL

Priority MEDIUM 64

AzuraCast (Composer package azuracast/azuracast) before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme (Utilities\Urls::parseUserUrl, used by StationRemote::getUrlAsUri) and…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00219 Published 2026-09-27 Fixed in 0.23.8 CWE-918
TI-2026-64985 CVE-2026-100847 · GHSA-hv9j-9524-hrq6

AzuraCast before 0.23.8 DQL Injection via sortOrder

Priority HIGH 77

AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00322 Published 2026-09-27 Fixed in 0.23.8 CWE-89