Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

AzuraCast before 0.23.6 remote relay password can run code

CVE-2026-100856 · published 13 days ago
Summary

The version of AzuraCast earlier than 0.23.6 lets anyone with the RemoteRelays permission insert special text into the relay password field that can cause the underlying streaming software to execute unwanted commands. This could expose internal keys or stop the station from playing. Update AzuraCast to version 0.23.6 or later and restrict RemoteRelays rights to trusted personnel.

What to do
  • Update azuracast azuracast to version 0.23.6.
Affected software
Ecosystem VendorProductAffected versions
composer azuracast azuracast <= 0.23.5
Fix: upgrade to 0.23.6
Original advisory text
AzuraCast before 0.23.6 Code Injection via Remote Relay Password
AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute arbitrary code in the Liquidsoap process, disclose internal API keys, or disrupt station operation.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.4 Critical
Type
CWE-94Code Injection
Timeline
Published27 Sep 2026
Updated27 Sep 2026
First seen4 May 2026
Sources
GHSA-q4ph-8x8g-95f8 · GHSA
CVE-2026-100856 · OSV
Track software like this
Free during beta