CVE-2026-121432

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.24.0

Description Low-privilege station users can perform a CRLF injection, which occurs when carriage return (CR) and line feed (LF) characters are improperly handled, allowing an attacker to insert new lines into a document. Users with Station:MountPoints or Station:RemoteRelays permissions can embed these sequences in the display name values of mounts or remote relays. This allows the injection of FileN= and TitleN= lines into the public playlist.pls file, potentially redirecting guest listeners to streams controlled by the attacker while appearing under the victim station's name.

Recommendations Update to version 0.24.0 or later.