CVE-2026-121432Low· 3.5▾ SunlitAzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay display_name values. Attackers with Station:MountPoi…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 19.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay display_name values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and TitleN= lines into the public playlist.pls to redirect guest listeners to attacker-controlled streams under the victim station's name.
AzuraCast < 0.24.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-121428High· 8.8AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone
CVE-2026-121429High· 8.8AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()
CVE-2026-121433Medium· 5.4AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export
CVE-2026-121430Medium· 5.4AzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints
CVE-2026-121431Medium· 5.3AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectors
CVE-2026-121427High· 7.5AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config