CVE-2026-121430— AzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints

Quick assessment

Affected

AzuraCast AzuraCast

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

AzuraCast 在 0.24.0 之前版本中，其和路由存在缺失授权验证的漏洞，原因是这些路由未包含权限中间件。任何已认证但未分配至特定电台的用户，均可读取其他电台的缓存波形 JSON 文件，并用攻击者提供的数据覆盖该文件，从而导致视觉提示编辑器（Visual Cue Editor）的数据被破坏。

CVSS 5.4 · Medium Updated Nov 03, 2026

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

AzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints

Source: CVE Program / CVE List V5

Vulnerability Description

AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST /api/station/{station_id}/waveform/{media_id} routes, which lack Permissions middleware. Any authenticated user without station assignment can read another station's cached waveform JSON and overwrite it with attacker-supplied data, corrupting Visual Cue Editor data.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
AzuraCast	AzuraCast	0 ~ 0.24.0	-

II. Public POCs for CVE-2026-121430

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121430

请登录查看更多情报信息。

Other References for CVE-2026-121430 (2)

https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-q3x9-qgv6-hgq3 vendor-advisory
https://www.vulncheck.com/advisories/azuracast-before-0.24.0-missing-authorization-via-station-waveform-endpoints third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121430

Same Patch Batch · AzuraCast · 2026-11-03 · 7 CVEs total

CVE-2026-121428	8.8 HIGH	AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone
CVE-2026-121429	8.8 HIGH	AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()
CVE-2026-121427	7.5 HIGH	AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config
CVE-2026-121433	5.4 MEDIUM	AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export
CVE-2026-121431	5.3 MEDIUM	AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectors
CVE-2026-121432	3.5 LOW	AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist

IV. Related Vulnerabilities

Same product: AzuraCast

Same vendor: AzuraCast

Same weakness: CWE-862