p PatchFirst

CVE-2026-100854

CVE-2026-100854 · AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API

This page contains facts from public vulnerability sources. Check the original advisory before updating.

AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and disclose filesystem paths.

CVSS 5.3 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • azuracast

    Versions
    • ≥ 0, < 0.23.6: Affected (semver)
    • 0.23.6: Not affected (semver)

    Update to 0.23.6

  • azuracast/azuracast Packagist

    Versions
    • 0.10.0
    • 0.10.1
    • 0.10.2
    • 0.10.3
    • 0.10.4
    • 0.11
    • 0.11.1
    • 0.11.2
    • 0.12
    • 0.12.1
    • 0.12.2
    • 0.12.3
    • 0.12.4
    • 0.13.0
    • 0.14.0
    • 0.14.1
    • 0.15.0
    • 0.15.1
    • 0.15.2
    • 0.16.0
    • 0.16.1
    • 0.17.0
    • 0.17.1
    • 0.17.2
    • 0.17.3
    • 0.17.4
    • 0.17.5
    • 0.17.6
    • 0.17.7
    • 0.18.0
    • 0.18.1
    • 0.18.2
    • 0.18.3
    • 0.18.5
    • 0.19.0
    • 0.19.1
    • 0.19.2
    • 0.19.3
    • 0.19.4
    • 0.19.5
    • 0.19.6
    • 0.19.7
    • 0.20.0
    • 0.20.1
    • 0.20.2
    • 0.20.3
    • 0.20.4
    • 0.21.0
    • 0.22.0
    • 0.22.1
    • 0.23.0
    • 0.23.1
    • 0.23.2
    • 0.23.3
    • 0.23.4
    • 0.23.5
    • 0.3.1
    • 0.3.2
    • 0.3.3
    • 0.5.0
    • 0.6.0
    • 0.8.0
    • 0.9.0
    • 0.9.1
    • 0.9.2
    • 0.9.3
    • 0.9.4
    • 0.9.4.1
    • 0.9.4.2
    • 0.9.5
    • 0.9.5.1
    • 0.9.6
    • 0.9.6.1
    • 0.9.6.2
    • 0.9.6.5
    • 0.9.7
    • 0.9.7.1
    • 0.9.8
    • 0.9.8.1
    • 0.9.9
    Affected ranges
    • ECOSYSTEM: < 0.23.6

    Update to 0.23.6

Original sources

Check your server →