AzuraCast vulnerabilities

CVEs per yearBy the year they were published

1. 20232
2. 20251
3. 202621

Newest CVEs

• CVE-2026-121433

  AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export

  AzuraCast · AzuraCast

  Medium5.1
• CVE-2026-121432

  AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist

  AzuraCast · AzuraCast

  Medium5.1
• CVE-2026-121431

  AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectors

  AzuraCast · AzuraCast

  Medium6.9
• CVE-2026-121430

  AzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints

  AzuraCast · AzuraCast

  Medium5.3
• CVE-2026-121429

  AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()

  AzuraCast · AzuraCast

  High8.7
• CVE-2026-121428

  AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone

  AzuraCast · AzuraCast

  High8.7
• CVE-2026-121427

  AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config

  AzuraCast · AzuraCast

  High8.7
• CVE-2026-100857

  AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation

  AzuraCast · AzuraCast

  High8.6
• CVE-2026-100856

  AzuraCast before 0.23.6 Code Injection via Remote Relay Password

  AzuraCast · AzuraCast

  High8.7
• CVE-2026-100855

  AzuraCast before 0.23.6 Missing Permission Check via /play

  AzuraCast · AzuraCast

  High7.1