CVE-2026-100853 in AzuraCast
Summary
by MITRE • 09/27/2026
In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly requesting media via the download endpoint using valid media identifiers, exposing private or restricted audio content.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/27/2026
The vulnerability identified in AzuraCast versions prior to 0.23.8 represents a critical failure in server-side access control mechanisms within the public On-Demand download functionality. This flaw specifically affects how the application validates user permissions when processing requests for media file downloads. The core technical issue lies in the endpoint's logic, which accepts valid media identifiers from unauthenticated users but fails to cross-reference these identifiers against the playlist-level access controls defined by station operators. In a properly secured system, any request to retrieve or download content should trigger a comprehensive permission check that verifies whether the requesting entity has explicit authorization for the specific asset and its associated context, such as the playlist it belongs to. However, in this vulnerable implementation, the application relies solely on the validity of the media identifier itself rather than enforcing the broader access policies configured by the administrator. This architectural oversight allows an attacker who possesses a valid media ID to bypass intended restrictions entirely.
From an operational perspective, this vulnerability enables unauthenticated actors to download audio files that are explicitly excluded from On-Demand-enabled playlists or marked as private within the AzuraCast station configuration. Station operators typically use these access controls to manage content distribution, ensuring that only subscribed users or specific audiences can access premium or restricted material. By exploiting this flaw, attackers can circumvent these business logic constraints and extract sensitive audio data without any form of authentication. The impact extends beyond simple unauthorized access; it compromises the integrity of the station's content strategy and potentially violates licensing agreements if copyrighted material is redistributed freely. Furthermore, because the attack does not require valid credentials or complex exploitation techniques, it poses a significant risk to small-to-medium radio stations that may lack robust security monitoring capabilities.
This vulnerability aligns with CWE-284, which describes Improper Access Control, as well as CWE-601, URL Redirection to Untrusted Site (if applicable in related contexts) but primarily falls under the category of broken object level authorization where the system fails to ensure that users are only accessing objects they have been granted permission for. In terms of the MITRE ATT&CK framework, this behavior is characteristic of T1078 Valid Accounts if credentials were used, but since it involves unauthenticated access due to a logic flaw, it maps more closely to techniques involving exploitation of misconfigured permissions or lack of proper input validation regarding resource ownership. The attack vector is straightforward and can be executed remotely over the network with low complexity, requiring only knowledge of valid media identifiers which may often be discoverable through standard API endpoints or public playlist listings.
To mitigate this vulnerability, organizations running AzuraCast must immediately upgrade to version 0.23.8 or later where these access control checks have been corrected. Until an update can be applied, administrators should consider implementing network-level controls such as web application firewalls that restrict direct access to the download endpoint based on IP reputation or rate limiting to reduce exposure. Additionally, reviewing API documentation and restricting public-facing endpoints for sensitive media assets until patches are deployed is a recommended interim measure. It is also crucial to audit existing playlists and media libraries to identify any content that may have been exposed during the window of vulnerability. Regular security assessments focusing on access control logic are essential to prevent similar issues in future updates, ensuring that all resource retrieval operations strictly enforce defined user permissions regardless of the method used to request them.