11 matches found
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the Liquidsoap API endpoint due to missing internal connection requirements and improper validation of the AutoDJ flag. An attacker can inject arbitrary now-playing metadata, disrupt live broadcasts, and disclo...
CVE-2026-100854
AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and...
CVE-2026-100854 AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API
AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and...
CVE-2026-100854 AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API
AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and...
EUVD-2026-87834
AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and...
CVE-2026-100854
AzuraCast versions before 0.23.6 are vulnerable to a metadata injection flaw via the Liquidsoap API . The root cause is the missing RequireInternalConnection middleware on the API endpoint and the incorrect derivation of the AutoDJ flag from header presence instead of a validated value. An attack...
CVE-2026-100854 AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API
AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and...
CVE-2026-100854: Missing Authorization
AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and...
GHSA-4FM3-GGG2-C6QX AzuraCast's Missing RequireInternalConnection on Liquidsoap API Allows Low-Privilege Metadata Injection and Broadcast Disruption
Summary The /api/internal/stationid/liquidsoap/action endpoint is accessible from the public web interface because it lacks the RequireInternalConnection middleware that protects other internal endpoints /sftp-auth, /sftp-event. Combined with a logic flaw where the $asAutoDj flag is set based on...
PT-2026-99474
Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.6 Description The software lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence instead of a validated value. This allows users...
PT-2026-41217
Summary The /api/internal/station id/liquidsoap/action endpoint is accessible from the public web interface because it lacks the RequireInternalConnection middleware that protects other internal endpoints /sftp-auth, /sftp-event. Combined with a logic flaw where the $asAutoDj flag is set based on...