Live › vulnerability › CVE-2026-121432
AzuraCast before 0.24.0 accepts carriage return and line feed characters in mount point and remote relay display names. A low-privilege station user can inject extra entries into the public playlist.pls file, redirecting listeners to attacker-controlled streams under the station's name.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Self-hosted AzuraCast instances before 0.24.0 where station staff hold the MountPoints or RemoteRelays permission. The attack needs a logged-in station user with those permissions; instances without such delegated users have less exposure. Operators running only admin accounts can deprioritise it.
No product ranges from the sources yet.
0.24.0 or later is not affected by this issue, earlier versions are.0.24.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay display_name values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and TitleN= lines into the public playlist.pls to redirect guest listeners to attacker-controlled streams under the victim station's name.
This page as .md · .json · in your agent: get_signal("CVE-2026-121432")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.