Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the Liquidsoap API endpoint due to missing internal connection requirements and improper validation of the AutoDJ flag. An attacker can inject arbitrary now-playing metadata, disrupt live broadcasts, and disclo...

PT-2026-99474

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.6 Description The software lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence instead of a validated value. This allows users...