SB2026102505 - CRLF injection in AzuraCast

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102505

SB2026102505 - CRLF injection in AzuraCast

Published: October 25, 2026

Security Bulletin ID SB2026102505
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) CRLF injection (CVE-ID: N/A)

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to redirect listeners to an attacker-controlled stream displayed under the victim station's name by injecting entries into its public PLS playlist.

The vulnerability exists due to improper neutralization of CRLF sequences in AzuraCast's public PLS playlist generation when embedding mount or remote relay display_name values into TitleN= lines. A remote user can set a display_name containing carriage returns, line feeds, and additional FileN= and TitleN= entries using the Station:MountPoints or Station:RemoteRelays permission to spoof playlist content when a listener downloads and opens the playlist in a media player that honors the injected entries.


Remediation

Install update from vendor's website.

References