AzuraCast versions prior to 0.23.6 have a vulnerability in the Liquidsoap API endpoint due to missing internal connection middleware and improper API key validation. This allows any user with the lowest station-level permission (View) to invoke privileged commands, inject arbitrary now-playing metadata, disrupt live broadcasts, and disclose absolute filesystem paths. The flaw arises because the endpoint is accessible publicly without the RequireInternalConnection middleware, and the $asAutoDj flag is set based on the presence of the X-Liquidsoap-Api-Key header rather than its validated value. A fix is available in version 0.23.6.