CVE-2026-100853: AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass
In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly requesting media via the download endpoint using valid media identifiers, exposing private or restricted audio content.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AzuraCastto a version that resolves this vulnerability.Fixed in 0.23.8
Event History
Frequently Asked Questions
Who is exposed to this issue?
AzuraCast deployments before 0.23.8 are exposed where media files are intended to be restricted by playlist-level On-Demand access controls. Content not included in an On-Demand-enabled playlist may still be retrievable.
What does an attacker need to exploit it?
No authentication or user interaction is required. An attacker needs valid media identifiers and can directly request the public On-Demand download endpoint.
What is the impact of successful exploitation?
An unauthenticated attacker can download private or restricted audio media that station operators intended to exclude from On-Demand access. The reported impact is confidentiality loss; integrity and availability are not affected.
How can I determine whether my deployment is affected?
Check whether the AzuraCast version is earlier than 0.23.8 and whether the station relies on playlist-level controls to restrict On-Demand media. Affected behavior is indicated if a direct download request using a valid identifier retrieves media excluded from On-Demand-enabled playlists.