CVE-2026-100856
AzuraCast before 0.23.6 Code Injection via Remote Relay Password
- State
- Published
- Severity
- 8.7 High
- Published
- Sep 27, 2026
- Updated
- Oct 8, 2026
- Reserved
- Sep 27, 2026
Description
AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute arbitrary code in the Liquidsoap process, disclose internal API keys, or disrupt station operation.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected Products
| Product | Versions |
|---|---|
AzuraCastAzuraCast |
|
References
- GitHub Security Advisory (GHSA-q4ph-8x8g-95f8)vendor-advisory
- VulnCheck Advisory: AzuraCast before 0.23.6 Code Injection via Remote Relay Passwordthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.