CVE-2023-2531
Improper Restriction of Excessive Authentication Attempts in azuracast/azuracast
Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Improper Restriction of Excessive Authentication Attempts in azuracast/azuracast
Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3.
- Record
CVE-2023-2531- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-307
- Updated
- 2026-11-02
EUVDEUVD-2023-1468
Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3.
- Record
EUVD-2023-1468- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4m7v-wr6v-2mw5
AzuraCast missing brute force prevention
The request rate limiting feature on the login page of AzuraCast before version 0.18.3 can be bypassed, which could allow an attacker to brute force login credentials.
- Record
GHSA-4m7v-wr6v-2mw5- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-307
- Updated
- 2026-11-02
NVD
Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3.
- Record
CVE-2023-2531- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-307
- Updated
- 2026-11-02
OSV
Improper Restriction of Excessive Authentication Attempts in azuracast/azuracast
Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3.
- Record
CVE-2023-2531- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-307
- Updated
- 2026-11-02
OSVGHSA-4m7v-wr6v-2mw5
AzuraCast missing brute force prevention
The request rate limiting feature on the login page of AzuraCast before version 0.18.3 can be bypassed, which could allow an attacker to brute force login credentials.
- Record
GHSA-4m7v-wr6v-2mw5- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-307
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
azuracast/azuracastPackagist |
before 0.18.3 | 0.18.3 |
azuracast/azuracastPackagist |
before 0.18.3, plus listed versions 0.10.00.10.10.10.20.10.30.10.4 Show 45 moreShow less0.110.11.10.11.20.120.12.10.12.20.12.30.12.40.13.00.14.00.14.10.15.00.15.10.15.20.16.00.16.10.17.00.17.10.17.20.17.30.17.40.17.50.17.60.17.70.18.00.18.10.18.20.3.10.3.20.3.30.5.00.6.00.8.00.9.00.9.10.9.20.9.30.9.40.9.4.10.9.4.20.9.50.9.5.10.9.60.9.6.10.9.6.2 |
0.18.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-2531 is a high vulnerability (CVSS 7.3) in Azuracast, published May 5, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.79%, the 56th percentile. Fixed in azuracast/azuracast 0.18.3.
References
huntr.dev/bounties/20463eb2-0f9d-4ea3-a2c8-93f80e7aca02
github.com/azuracast/azuracast/commit/bdb23594ad3e0c47c8568ce028a7c244a406cf9d
nvd.nist.gov/vuln/detail/CVE-2023-2531
Left out here: 6 versions. The JSON record has them.