CVE-2026-100854 in AzuraCast
Summary
by MITRE • 09/27/2026
AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and disclose filesystem paths.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/27/2026
The vulnerability in AzuraCast versions prior to 0.23.6 represents a critical failure in access control logic within the Liquidsoap API endpoint, which is responsible for managing audio streaming configurations. The core technical flaw stems from two distinct but related issues: the absence of middleware designed to restrict internal connections and an incorrect validation mechanism for authentication flags. Specifically, the application fails to enforce the RequireInternalConnection middleware on this specific endpoint, allowing external actors with valid user credentials to interact directly with system-level broadcasting controls that should be restricted to internal service-to-service communication only. This architectural oversight bypasses a significant layer of defense intended to isolate sensitive administrative functions from standard web-facing interfaces.
Compounding the access control failure is the flawed logic used to determine whether an AutoDJ operation is authorized. The application incorrectly derives the AutoDJ flag based solely on the presence or absence of specific HTTP headers rather than validating their actual values against a secure, server-side state database. This means that if a user possesses the View station permission, they can manipulate header fields in API requests to trick the backend into believing an operation is authorized for automatic digital broadcasting management. By exploiting this misinterpretation of header data, authenticated users with limited privileges are able to escalate their effective permissions and execute commands intended only for high-privilege administrators or internal services.
The operational impact of these vulnerabilities allows a malicious actor with View station permission to perform actions that severely disrupt service integrity and compromise system security. The most immediate consequence is the ability to inject arbitrary now-playing metadata into the broadcast stream. This capability can be used to display misleading information, defame artists, or confuse listeners, thereby damaging the reputation of the radio station operator. Furthermore, attackers can disrupt live broadcasts by manipulating Liquidsoap configurations, potentially causing audio dropouts, silence, or unintended playback errors that interrupt ongoing transmissions and degrade the listener experience significantly.
Beyond service disruption, the vulnerability poses a serious risk to system confidentiality through information disclosure. The flawed API interaction allows users to probe internal server structures, leading to the exposure of filesystem paths on the underlying operating system. This leakage of path data can aid attackers in further reconnaissance efforts, potentially facilitating more advanced attacks such as local file inclusion or path traversal exploits if other vulnerabilities exist within the application stack. The combination of unauthorized configuration changes and information disclosure creates a high-severity risk profile that undermines both the availability and confidentiality aspects of the CIA triad for AzuraCast deployments.
From an industry standard perspective, this vulnerability aligns with CWE-284 Improper Access Control, as it involves granting users access to resources or functions they are not authorized to use due to flawed logic in permission checks. Additionally, the exploitation technique relates to CWE-306 Missing Authentication for Critical Function, where a critical function is executed without proper authentication verification of its intended scope. In terms of MITRE ATT&CK mapping, this behavior corresponds to T1548 Abuse Elevation Control Mechanism, as attackers abuse system mechanisms like header validation logic to escalate privileges or bypass security controls. It also touches upon T1078 Valid Accounts, where legitimate credentials are leveraged to perform unauthorized actions due to insufficient authorization checks on specific endpoints.
To mitigate these risks, administrators must upgrade AzuraCast to version 0.23.6 or later immediately, as this release addresses the missing middleware and corrects the AutoDJ flag validation logic. Until an update is applied, it is advisable to restrict network access to the Liquidsoap API endpoint using firewall rules or reverse proxy configurations that limit connectivity to trusted internal IP ranges only. This compensating control effectively neutralizes the external attack surface by ensuring that even if header manipulation occurs, the request cannot reach the vulnerable application logic from outside the local environment. Regular security audits and penetration testing of custom deployments are also recommended to identify similar access control weaknesses in other API endpoints before they can be exploited.