CVE-2026-100854: AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-27 · updated 2026-10-08
Weakness: CWE-862

Description

AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and disclose filesystem paths.

Affected products

AzuraCast: before 0.23.6 — fixed in 0.23.6

How to fix

Upgrade to a fixed version: AzuraCast 0.23.6. Check the vendor advisory for mitigations.

References

https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-4fm3-ggg2-c6qx
https://www.vulncheck.com/advisories/azuracast-before-0.23.6-metadata-injection-via-liquidsoap-api
https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-4fm3-ggg2-c6qx

Get alerted when CVE-2026-100854 or the next vulnerability affects your stack