CVE-2026-100851

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.8

Description Broken access control allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. By calling the 'GET /api/station/{id}/vue/profile' endpoint, attackers with view-only access can obtain plaintext frontend credentials in the JSON response. These credentials can then be used to authenticate to the Icecast admin interface without requiring Broadcasting permission.

Recommendations Update to version 0.23.8 or later.