CVE-2026-100854 MEDIUM

CVE-2026-100854: AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API

Vendor Azuracast

Product AzuraCast

Weakness CWE-862 · Missing authorization

Published September 27, 2026

Last update September 27, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and disclose filesystem paths.

Key dates

02Disclosure timeline

September 27, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-100854 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html AskarLabs — CWE-862 write-up Missing Authorization

Related vulnerabilities

04Related CVE

CVE-2026-73401 WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability CVE-2026-66464 WordPress Internal Link Optimiser plugin <= 5.2.7 - Broken Access Control vulnerability CVE-2026-74021 WordPress Chaplin theme <= 2.6.8 - Broken Access Control vulnerability CVE-2026-73352 WordPress GiveWP plugin <= 4.16.5.1 - Broken Access Control vulnerability CVE-2026-66431 WordPress Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) plugin <= 1.0.7 - Broken Access Control vulnerability