Azuracast vulnerabilities

Products

• Azuracast 24
• Azuracast/azuracast 2

Newest

• azuracast AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connector Redirects CVE-2026-124442 7.1 HighNovember 8, 2026
• azuracast AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export CVE-2026-121433 5.1 MediumNovember 3, 2026
• azuracast AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist CVE-2026-121432 5.1 MediumNovember 3, 2026
• azuracast AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectors CVE-2026-121431 6.9 MediumNovember 3, 2026
• azuracast AzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints CVE-2026-121430 5.3 MediumNovember 3, 2026
• azuracast AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe() CVE-2026-121429 8.7 HighNovember 3, 2026
• azuracast AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone CVE-2026-121428 8.7 HighNovember 3, 2026
• azuracast AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config CVE-2026-121427 8.7 HighNovember 3, 2026
• azuracast AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass CVE-2026-100853 8.2 HighSeptember 27, 2026
• azuracast AzuraCast before 0.23.8 Command Injection via Streamer Username CVE-2026-100852 8.7 HighSeptember 27, 2026
• azuracast AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile CVE-2026-100851 7.2 HighSeptember 27, 2026
• azuracast AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist CVE-2026-100850 4.8 MediumSeptember 27, 2026
• azuracast AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs CVE-2026-100849 7.1 HighSeptember 27, 2026
• azuracast AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL CVE-2026-100848 7.1 HighSeptember 27, 2026
• azuracast AzuraCast before 0.23.8 DQL Injection via sortOrder CVE-2026-100847 8.7 HighSeptember 27, 2026
• azuracast AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass CVE-2026-76836 8.7 HighAugust 24, 2026
• azuracast AzuraCast before 0.23.6 Code Injection via Remote Relay Password CVE-2026-100856 Fix available 8.7 HighMay 4, 2026
• azuracast AzuraCast before 0.23.6 Missing Permission Check via /play CVE-2026-100855 Fix available 7.1 HighMay 4, 2026
• azuracast AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API CVE-2026-100854 Fix available 5.3 MediumMay 4, 2026
• azuracast AzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA Bypass CVE-2026-42606 Fix available 8.1 HighMay 4, 2026
• azuracast AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload CVE-2026-42605 Fix available 8.8 HighMay 4, 2026
• azuracast AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation CVE-2026-100857 Fix available 8.6 HighMarch 9, 2026
• azuracast AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE CVE-2025-67737 Fix available 3.1 LowDecember 11, 2025
• azuracast, azuracast azuracast/azuracast +1 more Improper Restriction of Excessive Authentication Attempts in azuracast/azuracast CVE-2023-2531 Fix available 7.3 HighMay 5, 2023
• azuracast, azuracast azuracast/azuracast +1 more Cross-site Scripting (XSS) - Stored in azuracast/azuracast CVE-2023-2191 Fix available 3.5 LowApril 20, 2023