Azuracast vulnerabilities
25 CVEs and advisories name Azuracast as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-124442AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connector Redirects
- CVE-2026-121433AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export
- CVE-2026-121432AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist
- CVE-2026-121431AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectors
- CVE-2026-121430AzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints
- CVE-2026-121429AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()
- CVE-2026-121428AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone
- CVE-2026-121427AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config
- CVE-2026-100857AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation
- CVE-2026-100856AzuraCast before 0.23.6 Code Injection via Remote Relay Password
- CVE-2026-100855AzuraCast before 0.23.6 Missing Permission Check via /play
- CVE-2026-100854AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API
- CVE-2026-100853AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass
- CVE-2026-100852AzuraCast before 0.23.8 Command Injection via Streamer Username
- CVE-2026-100851AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile
- CVE-2026-100850AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist
- CVE-2026-100849AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs
- CVE-2026-100848AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL
- CVE-2026-100847AzuraCast before 0.23.8 DQL Injection via sortOrder
- CVE-2026-76836AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass
- CVE-2026-42605AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload
- CVE-2026-42606AzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA Bypass
- CVE-2025-67737AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE
- CVE-2023-2531Improper Restriction of Excessive Authentication Attempts in azuracast/azuracast
- CVE-2023-2191Cross-site Scripting (XSS) - Stored in azuracast/azuracast