CVE-2026-121432
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
50/100
Published: 2026-11-03
Modified: 2026-11-03
First seen: 2026-11-03
Status: active
Attack Surface
Network
Low Complexity
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
Passive
S:
X
AT:
None
VC:
None
VI:
Low
VA:
None
Description
AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay display_name values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and TitleN= lines into the public playlist.pls to redirect guest listeners to attacker-controlled streams under the victim station's name.
Weakness Classification (1)
Affected Software (2)
References & Advisories (2)
vendor-advisory
third-party-advisory