PT-2026-99473 · Azuracast · Azuracast

Ikkyu3

·

CVE-2026-100853

·

Published

2026-09-27

·

Updated

2026-09-28

CVSS v4.0

8.2

High

VectorAV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.8
Description The public On-Demand download endpoint fails to verify playlist-level access controls. This allows unauthenticated users to bypass intended access restrictions by directly requesting media via the download endpoint using valid media identifiers, which can expose private or restricted audio content that was excluded from On-Demand-enabled playlists.
Recommendations Update to version 0.23.8 or later.

Exploit

Fix

Missing Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-100853
GHSA-Q9CC-MP52-VRP9

Affected Products

Azuracast