# cve.now: Azuracast

The newest entries naming Azuracast as an affected vendor (up to 200), of 25 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-124442](https://cve.now/CVE-2026-124442.md): AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connector Redirects (CVSS 7.1)
- [CVE-2026-121433](https://cve.now/CVE-2026-121433.md): AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export (CVSS 5.1)
- [CVE-2026-121432](https://cve.now/CVE-2026-121432.md): AzuraCast before 0.24.0 CRLF Injection via Mount display\_name in PLS Playlist (CVSS 5.1)
- [CVE-2026-121431](https://cve.now/CVE-2026-121431.md): AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectors (CVSS 6.9)
- [CVE-2026-121430](https://cve.now/CVE-2026-121430.md): AzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints (CVSS 5.3)
- [CVE-2026-121429](https://cve.now/CVE-2026-121429.md): AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe() (CVSS 8.7)
- [CVE-2026-121428](https://cve.now/CVE-2026-121428.md): AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone (CVSS 8.7)
- [CVE-2026-121427](https://cve.now/CVE-2026-121427.md): AzuraCast through 0.23.8 Config Injection via frontend\_config.custom\_config (CVSS 8.7)
- [CVE-2026-100857](https://cve.now/CVE-2026-100857.md): AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation (CVSS 8.6)
- [CVE-2026-100856](https://cve.now/CVE-2026-100856.md): AzuraCast before 0.23.6 Code Injection via Remote Relay Password (CVSS 8.7)
- [CVE-2026-100855](https://cve.now/CVE-2026-100855.md): AzuraCast before 0.23.6 Missing Permission Check via /play (CVSS 7.1)
- [CVE-2026-100854](https://cve.now/CVE-2026-100854.md): AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API (CVSS 5.3)
- [CVE-2026-100853](https://cve.now/CVE-2026-100853.md): AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass (CVSS 8.2)
- [CVE-2026-100852](https://cve.now/CVE-2026-100852.md): AzuraCast before 0.23.8 Command Injection via Streamer Username (CVSS 8.7)
- [CVE-2026-100851](https://cve.now/CVE-2026-100851.md): AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile (CVSS 7.2)
- [CVE-2026-100850](https://cve.now/CVE-2026-100850.md): AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist (CVSS 4.8)
- [CVE-2026-100849](https://cve.now/CVE-2026-100849.md): AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs (CVSS 7.1)
- [CVE-2026-100848](https://cve.now/CVE-2026-100848.md): AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL (CVSS 7.1)
- [CVE-2026-100847](https://cve.now/CVE-2026-100847.md): AzuraCast before 0.23.8 DQL Injection via sortOrder (CVSS 8.7)
- [CVE-2026-76836](https://cve.now/CVE-2026-76836.md): AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass (CVSS 8.7)
- [CVE-2026-42605](https://cve.now/CVE-2026-42605.md): AzuraCast: Path Traversal in \`currentDirectory\` Parameter Enables Remote Code Execution via Media Upload (CVSS 8.8)
- [CVE-2026-42606](https://cve.now/CVE-2026-42606.md): AzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA Bypass (CVSS 8.1)
- [CVE-2025-67737](https://cve.now/CVE-2025-67737.md): AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE (CVSS 3.1)
- [CVE-2023-2531](https://cve.now/CVE-2023-2531.md): Improper Restriction of Excessive Authentication Attempts in azuracast/azuracast (CVSS 7.3)
- [CVE-2023-2191](https://cve.now/CVE-2023-2191.md): Cross-site Scripting (XSS) - Stored in azuracast/azuracast (CVSS 3.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/azuracast
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.