AzuraCast CVE-2026-121432

Requires an authenticated station user with the Station:MountPoints or Station:RemoteRelays permission on at least one station (no admin needed), because display_name is writable only through those roles. The station's public page must be enabled (the default) so guests can fetch GET /public/{station}/playlist.pls. Exploitation is second-order and depends on victim interaction: an unauthenticated guest must download the .pls playlist AND use a media player that honors injected FileN= entries (many ignore NumberOfEntries). Limiting factors: the low-privilege-but-authenticated prerequisite, the reliance on guest download plus a tolerant player, and the fact that impact is confined to content spoofing/listener redirection (no code execution, no data exposure). Workaround per the advisory: disable the public page or unset the affected mounts' is_visible_on_public_pages flag so the playlist is not served to guests.

This is a genuine but low-severity, content-spoofing issue rather than a high-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N, scored 5.1) and the vendor's own CVSS 3.1 equivalent (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N, 3.5) agree: network-reachable and low-complexity, but requiring authenticated low-privilege access (PR:L) plus victim interaction (UI:P/R), with only a limited integrity impact (VI:L/I:L) and no confidentiality, availability, code execution, or data exposure. The vuln.today decision label is 'this_month' - a routine, scheduled-remediation priority, not act_now/emergency. No CISA KEV listing and no EPSS score were supplied, so there is no signal of active or probabilistic exploitation; absence of these is not evidence of safety but does not elevate priority. A detailed public PoC with full reproduction steps exists in the GitHub Security Advisory (GHSA-cqgx-rqjr-5gf4), which lowers the bar to reproduce. The strongest signal tempering risk is the privilege requirement and the second-order nature of the attack: an attacker must already hold a Station:MountPoints or Station:RemoteRelays role on a station and depends on an unauthenticated guest downloading the playlist into a tolerant media player. Net: a real but narrow abuse-of-role/listener-phishing bug, appropriate for scheduled patching, not crisis response.

A low-privilege user holding Station:MountPoints (or Station:RemoteRelays) permission on one station sets a mount's display_name to a value containing CR/LF sequences followed by injected FileN=/TitleN= lines. Because display_name is only length-truncated and never CR/LF-filtered, those lines are written raw into the guest-facing playlist.pls; an unauthenticated listener who downloads the station's public playlist has their media player redirected to an attacker-controlled stream presented under the victim station's name. A full working PoC (curl commands plus a negative control) is published in the GitHub Security Advisory.