Code Injection in AzuraCast - CVE-2026-76836
Published: October 25, 2026
Vulnerability details
The vulnerability allows a remote user to execute arbitrary operating system commands through unauthorized modification of AzuraCast's Liquidsoap configuration.
The vulnerability exists due to code injection and incorrect authorization in the PUT /api/station/{station_id}/profile/edit endpoint when processing backend_config custom configuration fields through the profile edit serialization context. A remote user can use manage station profile permission, without Broadcasting permission, to submit Liquidsoap code invoking process.run() or process.exec(), which is written verbatim into the generated .liq script and executes operating system commands when the built-in sync task automatically restarts the Liquidsoap backend.