Medium
AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API
AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and disclose filesystem paths.
Announced Group revision 1
Original source ↗CVE-2026-100854
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-100854
AzuraCast
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "AzuraCast",
"product": "AzuraCast",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "0.23.6",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.23.6",
"versionType": "semver"
}
],
"packageURL": "pkg:composer/azuracast/azuracast",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-100854
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #12683 · Revision 1
- Added to Heist Feed
- Publisher date