{"id":"CVE-2026-121432","title":"AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist","summary":"AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay display_name values. Attackers with Station:MountPoi…","severity":"low","cvss":3.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-93"],"vendor":"AzuraCast","product":"AzuraCast","affected":["AzuraCast < 0.24.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-03T17:21:41.446844Z"},"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T18:29:09.546Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121432","references":[{"url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-cqgx-rqjr-5gf4","label":"GitHub Security Advisory (GHSA-cqgx-rqjr-5gf4)"},{"url":"https://www.vulncheck.com/advisories/azuracast-before-0.24.0-crlf-injection-via-mount-display-name-in-pls-playlist","label":"VulnCheck Advisory: AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist"}],"tags":["cve.org"],"epss":0.00191,"epssPercentile":0.08857,"ingestedAt":"2026-11-05T20:33:06.354Z","slug":"CVE-2026-121432","body":"## Overview\n\nAzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay display_name values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and TitleN= lines into the public playlist.pls to redirect guest listeners to attacker-controlled streams under the victim station's name.\n\n## Affected\n\n- `AzuraCast < 0.24.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":19,"depthScoreParts":{"impact":19.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}