PT-2026-99474 · Azuracast · Azuracast
CVSS v3.1
6.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
AzuraCast versions prior to 0.23.6
Description
The software lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence instead of a validated value. This allows users with View station permission to inject arbitrary now-playing metadata, disrupt live broadcasts, and disclose filesystem paths.
Recommendations
Update to version 0.23.6 or later.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Azuracast