CVE-2026-100854: AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API
AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and disclose filesystem paths.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with the View station permission can exploit the affected Liquidsoap API endpoint. No user interaction is required.
Are default deployments affected?
The available data identifies AzuraCast versions before 0.23.6 as affected, but does not state whether the required View station permission is granted by default.
What access does an attacker need?
The attacker needs network access to the vulnerable endpoint and valid credentials for an account that has View station permission. The issue does not require elevated administrative permissions.
What can indicate that exploitation has occurred?
Potential indicators include unexpected or arbitrary now-playing metadata, disruption of live broadcasts, and exposure of filesystem paths. Review metadata changes and broadcast disruptions associated with accounts that have View station permission.
What is the remediation?
Update AzuraCast to version 0.23.6 or later. If immediate patching is not possible, restrict View station permission to trusted users and limit network access to the Liquidsoap API endpoint where feasible.