CVE-2026-100854 AzuraCast CVE debrief

Who should care

AzuraCast administrators, security teams, and users with View station permission should assess exposure and take necessary actions to mitigate the vulnerability. This includes reviewing and applying the vendor's advisory, verifying the system's current version, and restricting access to the Liquidsoap API. Additionally, operators and platform administrators should be aware of the potential disruption of live broadcasts and disclosure of filesystem paths.

Why it matters

AzuraCast administrators and security teams should assess exposure and take necessary actions to mitigate the vulnerability, as it allows for potential disruption of live broadcasts and disclosure of filesystem paths.

• Potential disruption of live broadcasts due to injected metadata
• Possible disclosure of filesystem paths
• Need for verification of current system version and potential upgrade to 0.23.6 or later
• Requirement for restricted access to the Liquidsoap API and validated user input

Technical summary

The AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and disclose filesystem paths. The vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. The affected product, AzuraCast, is a self-hosted web radio management suite. The vulnerability was publicly disclosed on 2026-09-27T01:28:46.412Z.

Defensive priority

Medium priority for AzuraCast administrators and security teams

Recommended defensive actions

• Review and apply the vendor's advisory (GHSA-4fm3-ggg2-c6qx) for patching and mitigation guidance
• Verify the system's current version and upgrade to 0.23.6 or later if necessary
• Restrict access to the Liquidsoap API to authorized users and validate user input
• Monitor for suspicious activity and implement additional security measures as needed
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability was publicly disclosed on 2026-09-27T01:28:46.412Z. The source item and CVE record do not provide additional information on the exploitation of this vulnerability. Defenders should verify the current system version and consider upgrading to 0.23.6 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.