Azuracast Before 0.23.8 Server Side Request Forgery Via Remote Relay Url

Back www.vulncheck.com

Azuracast Before 0.23.8 Server Side Request Forgery Via Remote Relay Url

www.vulncheck.com • September 27, 2026

Share: View original

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities Found in Azuracast Before Version 0.23.8 A series of vulnerabilities have been identified in Azuracast versions prior to 0.23.8, including broken access control, server-side request forgery (SSRF), and local file read issues. The vulnerabilities allow unauthorized access to sensitive information and the potential for remote exploitation. Specifically, CVE-2026-1234 addresses broken access control via the GET /api/station/{id}/vue/profile endpoint. CVE-2026-1235 involves SSRF filter bypass through hostname and private IPs, while CVE-2026-1236 includes SSRF and local file read vulnerabilities via remote playlists. The affected systems are primarily those running Azuracast versions below 0.23.8. Users are advised to upgrade to the latest version to mitigate these risks. No active exploitation has been reported as of now, but the vulnerabilities are significant enough to warrant immediate attention. 57

Extracted Entities

Attack Types (1)

Server-Side Request Forgery