Skip to content
OpenAdvisories

Vendor

AzuraCast

25 known vulnerabilities.

Products

AzuraCast 23 azuracast/azuracast 2
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-124442

    AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connector Redirects

    AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows users with station WebHooks permission to bypass the UserUrlFilter SSRF guard through HTTP redirects. Attackers can configure Mastodon, Telegram, GroupMe, or RadioReg web…

    AzuraCast AzuraCast
  • Medium 5.4
    CVE-2026-121433

    AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export

    AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /a…

    AzuraCast AzuraCast
  • Medium 5.3
    CVE-2026-121431

    AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectors

    AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass the UserUrlFilter guard via the Mastodon, Telegram, GroupMe, and RadioReg connectors. Attackers can set instance_url, api…

    AzuraCast AzuraCast
  • Medium 5.4
    CVE-2026-121430

    AzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints

    AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST /api/station/{station_id}/waveform/{media_id} routes, which lack Permissions middleware. Any authenticated user without station assignment can read another station's ca…

    AzuraCast AzuraCast
  • Medium 6.5
    CVE-2026-100855

    AzuraCast before 0.23.6 Missing Permission Check via /play

    AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/{station_id}/file/{id}/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequenti…

    AzuraCast AzuraCast azuracast/azuracast Packagist
  • Medium 6.3
    CVE-2026-100854

    AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API

    AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing met…

    AzuraCast AzuraCast azuracast/azuracast Packagist
  • Medium 5.9
    CVE-2026-100853

    AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass

    In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's in…

    AzuraCast AzuraCast