CVE-2026-121430: AzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints

Published Nov 3, 2026

Updated

AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST /api/station/{stationid}/waveform/{mediaid} routes, which lack Permissions middleware. Any authenticated user without station assignment can read another station's cached waveform JSON and overwrite it with attacker-supplied data, corrupting Visual Cue Editor data.

Event History

Nov 3, 2026

CVE Published

via MITRE·02:28 PM

Data Sourced

via MITRE·02:28 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated AzuraCast user can exploit it, including a user who has no assignment to the targeted station. The attacker must be able to send requests to the affected station waveform API routes and know or supply the target station and media identifiers.

What data or functionality is exposed?

An unauthorized user can read cached waveform JSON belonging to another station. They can also overwrite that cached waveform data with attacker-controlled content, corrupting Visual Cue Editor data.

Are unauthenticated users affected?

The described issue requires authentication. The vulnerability allows an authenticated user to bypass the missing station-level authorization checks; it does not state that anonymous access is possible.

What should be done if an immediate upgrade is not possible?

Limit access to AzuraCast accounts to trusted users and restrict authenticated users' ability to reach the affected waveform endpoints where feasible. Monitor for unexpected GET or POST requests to /api/station/{station_id}/waveform/{media_id} and investigate altered Visual Cue Editor waveform data.

How can administrators determine whether their deployment is affected?

Deployments running AzuraCast versions before 0.24.0 are affected according to the advisory. Review application and access logs for requests to the affected GET and POST waveform routes made by users who are not assigned to the referenced station.

CVE-2026-121430: AzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints

Event History

Frequently Asked Questions

Who can exploit this issue?

What data or functionality is exposed?

Are unauthenticated users affected?

What should be done if an immediate upgrade is not possible?

How can administrators determine whether their deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What data or functionality is exposed?

Are unauthenticated users affected?

What should be done if an immediate upgrade is not possible?

How can administrators determine whether their deployment is affected?