Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

AzuraCast — Vulnerabilities & Security Advisories 15

All 15 CVE vulnerabilities found in AzuraCast, with AI-generated Chinese analysis, references, and POCs.

This page documents security weaknesses associated with the AzuraCast radio broadcasting software, categorized by Common Weakness Enumerations and tracked under specific vendor advisories. It aggregates a comprehensive collection of vulnerabilities affecting this open-source platform, covering security issues reported from its initial releases through to the most recent updates. Here, users can discover and track the vendor's security advisories to stay informed about patch availability, understand the characteristics and impacts of specific weakness classes such as command injection or path traversal, and look up the complete vulnerability history of the product to assess its long-term security posture. The data includes details on affected versions, severity ratings, and exploitation contexts, providing a clear view of the threat landscape for AzuraCast deployments. This resource is designed for system administrators, security researchers, and developers who need accurate, historical context to prioritize remediation efforts and harden their installations against known flaws. By consolidating these records, the page offers a transparent overview of how the software has evolved in response to security findings, allowing stakeholders to make informed decisions about upgrades and configuration changes. It serves as a centralized reference point for anyone managing AzuraCast instances, ensuring that historical vulnerabilities are not overlooked in favor of current, actively exploited threats.

Vendor: AzuraCast

CVE ID Title CVSS Severity Published
CVE-2026-100857 AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation CWE-94 8.0 High 2026-09-27
CVE-2026-100856 AzuraCast before 0.23.6 Code Injection via Remote Relay Password CWE-94 8.8 High 2026-09-27
CVE-2026-100855 AzuraCast before 0.23.6 Missing Permission Check via /play CWE-862 6.5 Medium 2026-09-27
CVE-2026-100853 AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass CWE-862 5.9 Medium 2026-09-27
CVE-2026-100854 AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API CWE-862 6.3 Medium 2026-09-27
CVE-2026-100852 AzuraCast before 0.23.8 Command Injection via Streamer Username CWE-78 8.8 High 2026-09-27
CVE-2026-100850 AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist CWE-918 7.7 High 2026-09-27
CVE-2026-100851 AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile CWE-200 7.6 High 2026-09-27
CVE-2026-100849 AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs CWE-918 7.1 High 2026-09-27
CVE-2026-100848 AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL CWE-918 7.1 High 2026-09-27
CVE-2026-100847 AzuraCast before 0.23.8 DQL Injection via sortOrder CWE-89 7.5 High 2026-09-27
CVE-2026-76836 AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass CWE-94 8.8 High 2026-08-24
CVE-2026-42605 AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload CWE-22 8.8 High 2026-05-09
CVE-2026-42606 AzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA Bypass CWE-640 8.1 High 2026-05-09
CVE-2025-67737 AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE CWE-862 3.1 Low 2025-12-12

All 15 known CVE vulnerabilities affecting AzuraCast with full Chinese analysis, references, and POCs where available.