AzuraCast EUVD-2026-87836

Requires an authenticated AzuraCast account with BOTH Streamers and Profile permissions on a station (per-station low-privilege user, not admin). Exploitation depends on the live-recording feature being used: the injected username is only passed to process.run during Liquidsoap config generation for live recording, and command execution fires specifically when a recording session closes. This means the attacker must be able to set their streamer username, connect as a live streamer, and have recording enabled/triggered. These factors - a valid privileged station account plus an active live-recording workflow - limit exploitation to insiders or attackers who have already obtained streamer-level credentials; it is not exploitable against a default install with no streamer accounts.

This is a genuine but conditional priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) rates it 8.7, reflecting network reach and full CIA impact via OS command execution, but PR:L is the decisive limiter: the attacker must be an authenticated station user holding both Streamers and Profile permissions - not an anonymous internet attacker. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so exploitation is currently theoretical; per the precision rules this is 'no public exploit identified at time of analysis.' There is a subtle mismatch worth flagging: the vector states UI:N, yet the description says code executes 'when recording closes,' meaning a triggering event (recording session ending) is needed rather than pure fire-and-forget - this is closer to a delayed/deferred trigger than instantaneous, but does not require a separate victim, so UI:N is defensible. Overall: real command-injection-to-RCE risk for anyone running AzuraCast with semi-trusted streamer accounts, but the privileged-account prerequisite and niche deployment footprint keep real-world urgency at low-to-medium rather than critical.

An authenticated AzuraCast user with Streamers and Profile permissions sets their streamer username to a value embedding shell metacharacters (e.g. a command substitution or ';'-separated command). When they connect and later a live recording session closes, AzuraCast's Liquidsoap config generation passes the unquoted username into a process.run call, executing the injected command as the Liquidsoap process user. No public POC is referenced in the provided data.