- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
CyStack could not complete this security profile. The original vulnerability records remain available below.
As of 11/09/2026, AzuraCast recorded 20 security vulnerabilities in the last 90 days, of which 14 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of AzuraCast and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-124442AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connector RedirectsCVE-2026-121433Stored CSV formula injection in AzuraCast bulk media exportsCVE-2026-121432AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS PlaylistCVE-2026-121431AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook ConnectorsCVE-2026-121430AzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-124442AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connector Redirects | Exploitation statusNot confirmed | FixYes |
| SeverityHigh |
CVE-2026-121433Stored CSV formula injection in AzuraCast bulk media exports | Exploitation statusActively exploited | FixYes | Published11/03/2026 | SeverityMedium |
|---|
CVE-2026-121432AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist | Exploitation statusNot exploited | FixYes | Published11/03/2026 | SeverityMedium |
|---|
CVE-2026-121431AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectors | Exploitation statusNot confirmed | FixYes | Published11/03/2026 | SeverityMedium |
|---|
CVE-2026-121430AzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints | Exploitation statusNot confirmed | FixYes | Published11/03/2026 | SeverityMedium |
|---|
CVE-2026-121429AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe() | Exploitation statusActively exploited | FixYes | Published11/03/2026 | SeverityHigh |
|---|
CVE-2026-121428AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone | Exploitation statusNot exploited | FixYes | Published11/03/2026 | SeverityHigh |
|---|
CVE-2026-121427AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config | Exploitation statusNot confirmed | FixYes | Published11/03/2026 | SeverityHigh |
|---|
CVE-2026-100857AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation | Exploitation statusActively exploited | FixYes | Published09/27/2026 | SeverityHigh |
|---|
CVE-2026-100856AzuraCast before 0.23.6 Code Injection via Remote Relay Password | Exploitation statusActively exploited | FixYes | Published09/27/2026 | SeverityHigh |
|---|
CVE-2026-100855AzuraCast before 0.23.6 Missing Permission Check via /play | Exploitation statusActively exploited | FixYes | Published09/27/2026 | SeverityHigh |
|---|
CVE-2026-100854AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API | Exploitation statusActively exploited | FixYes | Published09/27/2026 | SeverityMedium |
|---|
CVE-2026-100853AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass | Exploitation statusActively exploited | FixYes | Published09/27/2026 | SeverityHigh |
|---|
CVE-2026-100852AzuraCast before 0.23.8 Command Injection via Streamer Username | Exploitation statusActively exploited | FixYes | Published09/27/2026 | SeverityHigh |
|---|
CVE-2026-100851AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile | Exploitation statusActively exploited | FixYes | Published09/27/2026 | SeverityHigh |
|---|
CVE-2026-100850AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist | Exploitation statusActively exploited | FixYes | Published09/27/2026 | SeverityMedium |
|---|
CVE-2026-100849AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs | Exploitation statusActively exploited | FixYes | Published09/27/2026 | SeverityHigh |
|---|
CVE-2026-100848AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL | Exploitation statusActively exploited | FixYes | Published09/27/2026 | SeverityHigh |
|---|
CVE-2026-100847AzuraCast before 0.23.8 DQL Injection via sortOrder | Exploitation statusActively exploited | FixYes | Published09/27/2026 | SeverityHigh |
|---|
CVE-2026-76836AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass | Exploitation statusActively exploited | FixYes | Published08/24/2026 | SeverityHigh |
|---|
CVE-2026-42606AzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA Bypass | Exploitation statusActively exploited | FixYes | Published05/09/2026 | SeverityHigh |
|---|
CVE-2026-42605AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload | Exploitation statusActively exploited | FixYes | Published05/09/2026 | SeverityHigh |
|---|
CVE-2025-67737AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE | Exploitation statusNot exploited | FixYes | Published12/12/2025 | SeverityLow |
|---|
23 Results | Page 1 of 1