---
id: CVE-2026-121432
title: AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist
summary: >-
  AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows
  low-privilege station users to inject playlist entries by embedding CR/LF
  sequences in mount or remote relay display_name values. Attackers with
  Station:MountPoi…
severity: low
cvss: 3.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-93
vendor: AzuraCast
product: AzuraCast
affected:
  - AzuraCast < 0.24.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T17:21:41.446844Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T18:29:09.546Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121432'
references:
  - url: >-
      https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-cqgx-rqjr-5gf4
    label: GitHub Security Advisory (GHSA-cqgx-rqjr-5gf4)
  - url: >-
      https://www.vulncheck.com/advisories/azuracast-before-0.24.0-crlf-injection-via-mount-display-name-in-pls-playlist
    label: >-
      VulnCheck Advisory: AzuraCast before 0.24.0 CRLF Injection via Mount
      display_name in PLS Playlist
tags:
  - cve.org
epss: 0.00191
epssPercentile: 0.08857
ingestedAt: '2026-11-05T20:33:06.354Z'
---

## Overview

AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay display_name values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and TitleN= lines into the public playlist.pls to redirect guest listeners to attacker-controlled streams under the victim station's name.

## Affected

- `AzuraCast < 0.24.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.