CVE-2026-100851 in AzuraCast
Summary
by MITRE • 09/27/2026
AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. Attackers with View-only access can call this endpoint and receive plaintext frontend credentials in the JSON response, then use the admin password to authenticate to the Icecast admin interface without Broadcasting permission.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/27/2026
The vulnerability identified in AzuraCast versions prior to 0.23.8 represents a critical failure in server-side access control mechanisms within the application's API layer. Specifically, this flaw resides in the GET /api/station/{id}/vue/profile endpoint, which is designed to retrieve profile information for radio stations managed through the platform. The core technical deficiency lies in the insufficient authorization checks performed by the backend logic when processing requests from authenticated users. While AzuraCast implements a role-based access control model that restricts certain actions based on user permissions such as View Station Page or Broadcasting, this specific endpoint fails to validate whether the requesting user possesses the necessary privileges to access sensitive configuration data. Consequently, any user who has been granted at least the basic View Station Page permission can trigger this API call and receive a JSON response containing plaintext credentials for Icecast and Shoutcast services, including admin passwords, source passwords, and relay configurations.
From an operational perspective, this broken access control vulnerability allows attackers with minimal initial privileges to escalate their influence over the radio broadcasting infrastructure significantly. By obtaining these plaintext credentials, an attacker can directly authenticate to the underlying streaming server interfaces, such as Icecast or Shoutcast, without requiring explicit Broadcasting permissions within AzuraCast itself. This bypasses the intended security boundaries of the application and grants unauthorized access to critical administrative functions on the media servers. The impact extends beyond mere information disclosure; it enables potential disruption of service through configuration changes, unauthorized broadcasting from source clients using stolen credentials, or further lateral movement if these passwords are reused across other systems. The exposure of relay passwords also compromises the integrity of distributed streaming networks, potentially allowing for traffic interception or manipulation at intermediate nodes.
This vulnerability aligns with CWE-269, which describes Improper Privilege Assignment, as well as CWE-862, Missing Authorization, highlighting the failure to enforce proper access control policies on sensitive resources. In terms of offensive security frameworks, this scenario maps closely to MITRE ATT&CK technique T1078, Valid Accounts, where adversaries leverage legitimate credentials obtained through privilege escalation or credential theft to maintain persistence and execute malicious activities within a network environment. The ability to authenticate directly to the streaming server using stolen passwords effectively grants the attacker administrative control over the media distribution layer, undermining the security model of the entire AzuraCast deployment.
To mitigate this risk, organizations running AzuraCast must immediately upgrade to version 0.23.8 or later, where these access control checks have been corrected to ensure that sensitive profile data is only accessible to users with appropriate administrative privileges. In addition to patching, administrators should enforce the principle of least privilege by auditing user roles and ensuring that View-only accounts do not possess unnecessary permissions that could be exploited for information gathering. It is also critical to rotate all exposed Icecast and Shoutcast passwords immediately following any suspected or confirmed exploitation of this vulnerability. Furthermore, implementing network-level restrictions on access to streaming server admin interfaces can provide an additional layer of defense-in-depth, limiting exposure even if application-layer controls are bypassed. Regular security audits and penetration testing focused on API endpoints should be conducted to identify similar authorization flaws in other parts of the system before they can be exploited by malicious actors.