CRLF injection in AzuraCast - #VU157648
Published: October 25, 2026
Vulnerability identifier: #VU157648
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-93
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to redirect listeners to an attacker-controlled stream displayed under the victim station's name by injecting entries into its public PLS playlist.
The vulnerability exists due to improper neutralization of CRLF sequences in AzuraCast's public PLS playlist generation when embedding mount or remote relay display_name values into TitleN= lines. A remote user can set a display_name containing carriage returns, line feeds, and additional FileN= and TitleN= entries using the Station:MountPoints or Station:RemoteRelays permission to spoof playlist content when a listener downloads and opens the playlist in a media player that honors the injected entries.
Affected software
AzuraCast
Remediation
Install security update from vendor's website.
AzuraCast - update to 0.19.1