CVE-2026-100854 AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API
Authenticated users can inject metadata and disclose paths due to missing internal connection checks on the Liquidsoap API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-100854?
CVE-2026-100854 is a medium-severity missing authorization vulnerability in AzuraCast, published on 27 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and disclose filesystem paths.
Weakness: CWE-862
Which versions are affected by CVE-2026-100854?
2 open source packages ship an affected version, including azuracast/azuracast.
| Package | Affected | Fixed in |
|---|---|---|
azuracast/azuracast Packagist | All versions | 0.23.6 |
azuracast/azuracast Packagist | All versions | 0.23.6 |
How do I fix CVE-2026-100854?
Upgrade azuracast/azuracast to 0.23.6 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-100854 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-100854 exists.
Sources
Also known as GHSA-4fm3-ggg2-c6qx, GHSA-m6mg-63cr-44jj.