AzuraCast versions prior to 0.24.0 contain a server-side request forgery (SSRF) vulnerability that allows users with station WebHooks permission to bypass the UserUrlFilter SSRF protection via HTTP redirects. This enables attackers to configure certain webhooks to indirect URLs that cause the internal Guzzle HTTP client to access internal services and expose responses in test logs. The vulnerability is fixed in version 0.24.0.
AzuraCast versions prior to 0.24.0 contain a stored CSV formula injection vulnerability. This flaw allows users with Media permission to inject malicious formulas into CSV metadata fields during bulk media import. When other users export and open these CSV files in spreadsheet applications, the formulas can execute, potentially leading to unintended actions or data exposure. The vulnerability is fixed in version 0.24.0.
AzuraCast versions before 0.24.0 have a CRLF injection vulnerability that allows low-privilege station users with specific permissions to inject playlist entries. By embedding CR/LF sequences in mount or remote relay display_name values, attackers can insert FileN= and TitleN= lines into the public playlist.pls file. This can redirect guest listeners to attacker-controlled streams while appearing under the victim station's name. The vulnerability is fixed in version 0.24.0.
AzuraCast versions prior to 0.24.0 contain a server-side request forgery (SSRF) vulnerability. This flaw allows station users with WebHooks permission to bypass URL filtering protections via certain connectors, enabling requests to internal or cloud metadata services. The vulnerability is fixed in version 0.24.0.
AzuraCast versions before 0.24.0 have a missing authorization vulnerability in the GET and POST /api/station/{station_id}/waveform/{media_id} API routes. These routes lack proper permissions middleware, allowing any authenticated user without station assignment to read and overwrite cached waveform JSON data of other stations. This can corrupt Visual Cue Editor data. The issue is fixed in version 0.24.0.
AzuraCast versions up to 0.23.8 have an OS command injection vulnerability that allows station users with Profile permission to execute arbitrary OS commands via specially crafted StereoTool settings. This occurs because user-supplied input in stereo_tool_configuration_path or stereo_tool_license_key is not properly neutralized and is executed by /bin/sh on station restart, potentially compromising the container.
CVE-2026-121428 is a high-severity remote code execution vulnerability in AzuraCast versions up to 0.23.8. Authenticated station managers can exploit this flaw by injecting malicious Supervisor configuration via the station timezone field, allowing execution of OS commands as root when the configuration regenerates.
CVE-2026-121427 is a vulnerability in AzuraCast versions up to 0.23.8 where insufficient permission checks allow an authenticated user with Manage station profile permission to modify critical Shoutcast configuration settings. This flaw enables overriding adminpassword, password, portbase, or injecting arbitrary directives into the Shoutcast sc_serv.conf file, potentially hijacking the station's frontend.
AzuraCast versions prior to 0.23.4 have a code injection vulnerability in the ConfigWriter::cleanUpString() method. This flaw allows authenticated users with Media or Profile permissions to inject arbitrary Liquidsoap code via unsanitized string interpolation sequences. Exploitation can lead to execution of shell commands as the azuracast user when the station restarts.
AzuraCast versions before 0.23.8 have a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint. This flaw allows authenticated users with only View Station Page permission to access Icecast/Shoutcast admin, source, and relay passwords in plaintext. Attackers can use the exposed admin password to authenticate to the Icecast admin interface without needing Broadcasting permission.
AzuraCast versions before 0.23.8 contain a server-side request forgery (SSRF) vulnerability in the station webhook URL validation. The validation incorrectly rejects only literal link-local IP addresses but allows loopback and private network addresses, enabling a user with station-scoped WebHooks permission to configure webhooks targeting internal or private network resources. This can cause the server to send HTTP POST requests with station data to unintended internal endpoints. The vulnerability can be triggered on demand via a specific test endpoint. No patch was available at the time of the advisory.
AzuraCast versions through 0.23.x have a command injection vulnerability in the Liquidsoap configuration generation for live recording. The vulnerability arises because the streamer username is not properly quoted in process.run calls, allowing authenticated station users with Streamers and Profile permissions to execute arbitrary commands as the Liquidsoap process user when recording ends.
AzuraCast versions prior to 0.23.8 have a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. This flaw allows attackers to inject arbitrary Doctrine Query Language expressions, potentially exposing sensitive database information such as user credentials and station settings.
AzuraCast versions before 0.23.8 have a vulnerability in the public On-Demand download endpoint that does not properly enforce playlist-level access controls. This flaw allows unauthenticated users to download media files that are meant to be excluded from On-Demand-enabled playlists, bypassing intended access restrictions and exposing private or restricted audio content.
AzuraCast versions prior to 0.23.6 have a vulnerability where the Liquidsoap API endpoint lacks the RequireInternalConnection middleware and incorrectly derives the AutoDJ flag from header presence instead of a validated value. This allows users with View station permission to inject arbitrary now-playing metadata, disrupt live broadcasts, and disclose filesystem paths.
AzuraCast versions prior to 0.23.6 contain a code injection vulnerability in the remote relay password field. This arises from incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can exploit this to inject nested Liquidsoap interpolation syntax, enabling arbitrary code execution within the Liquidsoap process, disclosure of internal API keys, or disruption of station operations.
AzuraCast versions before 0.23.8 have a server-side request forgery (SSRF) and local file read vulnerability in the AutoDJ remote playlist fetch functionality. A user with Media permission can craft a playlist referencing a file:// URL or internal HTTP endpoints, causing the backend to read local files or internal resources without proper restrictions. This can disclose sensitive files such as /etc/passwd or application environment files to users with Broadcasting permission. No patch was available at the time of publication.
AzuraCast versions prior to 0.23.6 have a missing permission check vulnerability in the GET /api/station/{station_id}/file/{id}/play endpoint. This flaw allows authenticated users to download media files from any station, including those they do not have permission to access. Attackers can enumerate media files using sequential IDs and exfiltrate entire media libraries of unauthorized stations.