EUVD-2026-87837
GHSA-6mwx-gw6f-5f36
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain View-only station account
-
DeliveryCall GET /api/station/{id}/vue/profile
-
ExploitReceive plaintext frontend passwords
-
ExecutionAuthenticate to Icecast admin interface
-
ImpactControl broadcast without Broadcasting permission
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated AzuraCast account holding the 'View Station Page' permission on the target station - no higher privilege is needed, and no user interaction or non-default configuration is required. The limiting factor is the authentication and permission grant: exploitation is only meaningful in multi-user/multi-tenant deployments where low-privilege View-only accounts are issued to untrusted or semi-trusted parties. Single-operator installations where only the admin has accounts face negligible real-world risk. Affected versions are AzuraCast before 0.23.8. |
| Impact | This is a moderate-severity broken-access-control issue, not a critical widespread threat. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N/VC:H/VI:L/VA:L, score 7.2) indicates network-reachable, low-complexity exploitation, but PR:L confirms the attacker must already hold a valid low-privilege account (specifically the 'View Station Page' permission) - this is a privilege-boundary bypass by an existing insider or a user granted minimal access, not an anonymous internet attacker. There is NO EPSS score, NO CISA KEV listing, and NO public POC provided, so all real-world exploitation signals are absent; the risk is theoretical/insider-driven rather than demonstrably active. The confidentiality impact is the real story (VC:H - plaintext streaming credentials), while VI:L/VA:L are generous - the direct vulnerability discloses data and does not itself modify or deny the AzuraCast system, so I assess integrity/availability as N for the primary flaw. Overall: prioritize for hardening in multi-tenant AzuraCast deployments where View-only accounts are handed out, but this is not an emergency patch for isolated single-operator installs. |
| Exploit ScenarioDerived | An AzuraCast operator grants a collaborator only 'View Station Page' permission, assuming they cannot touch broadcasting. The collaborator (or a compromised low-privilege account) issues an authenticated GET to /api/station/{id}/vue/profile and receives the Icecast/Shoutcast admin, source, and relay passwords in plaintext JSON, then logs into the Icecast admin interface to hijack or disrupt the stream despite never holding Broadcasting permission. No public POC is referenced, but the request is a single trivial API call. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 27, 2026
Authenticated users with only View Station Page permission on AzuraCast before 0.23.8 can retrieve plaintext Icecast/Shoutcast admin, source, and relay passwords from the GET /api/station/{id}/vue/profile endpoint. The exposed admin credentials permit logging into the Icecast admin interface without holding Broadcasting permission, escalating the attacker's effective access within the streaming infrastructure. This broken access control issue (CWE-200) is rated moderate severity and is realistically exploitable only in multi-user or multi-tenant deployments where untrusted or semi-trusted parties hold low-privilege View-only accounts; no public exploit identified at time of analysis.
RemediationAI
Upgrade AzuraCast to version 0.23.8 or later. Vendor-released patch: 0.23.8. If immediate upgrading is not possible, restrict the 'View Station Page' permission to only fully trusted users, and audit existing accounts that hold this permission. Additionally, consider network-level access controls to limit API endpoint exposure, but note that these are compensating controls with operational trade-offs. Refer to the vendor advisory at https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-qwh6-x463-ccf4 for detailed instructions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a broken access control vulnerability (CWE-200) in the AzuraCast API endpoint GET /api/station/{id}/vue/profile. AzuraCast is an open-source self-hosted web radio management platform that exposes administrative interfaces for Icecast/Shoutcast streaming servers. The endpoint fails to enforce authorization checks on the requesting user's permission level, returning plaintext Icecast/Shoutcast admin, source, and relay passwords in its JSON response. An attacker with only the 'View Station Page' permission can read these credentials and then use the admin password to authenticate to the Icecast admin interface without needing the Broadcasting permission. The issue affects all versions before 0.23.8. The vulnerability requires authenticated access with low privileges (PR:L) and no user interaction, leading to high confidentiality impact. No public exploit identified at time of analysis, and the vulnerability is not known to be actively exploited.
Know when Azuracast gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Network API call by an authenticated low-privilege View-only user (PR:L) with no interaction; direct impact is plaintext credential disclosure (C:H), with no integrity or availability impact from the flaw itself.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. Attackers with View-only access can call this endpoint and receive plaintext frontend credentials in the JSON response, then use the admin password to authenticate to the Icecast admin interface without Broadcasting permission.
Technical POC Analysis
Evidence basis: the supplied GitHub advisory GHSA-qwh6-x463-ccf4 only.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
AzuraCast deployments that serve multiple users - broadcasters, station staff, or tenants on View-only accounts - can disclose the plaintext administrative passwords protecting their Icecast/Shoutcast streaming servers, allowing a low-privilege account holder to take operational control of stations they were never authorized to manage. Because these credentials are typically shared across source, relay, and admin functions and are disruptive to rotate during live broadcasts, the exposure is most consequential in multi-user or multi-tenant environments. Leadership should care because station takeover, unauthorized content distribution, and streaming outages are plausible outcomes, and no vendor-released patch is available at the time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or restrict the View Station Page permission for untrusted and semi-trusted accounts; block or filter the GET /api/station/{id}/vue/profile endpoint for low-privilege roles at the reverse proxy or WAF; rotate Icecast/Shoutcast admin, source, and relay credentials; restrict the Icecast admin interface to trusted source IPs or a segmented internal network; enable logging and alerting on Icecast admin authentication and on requests to the affected endpoint; and validate and deploy the vendor release addressing versions prior to 0.23.8 once the advisory confirms it resolves CVE-2026-100851, followed by credential re-rotation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in AzuraCast SSRF, Injection, and Access Control Flaws
View all 11Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3. Rate
Cross-site Scripting (XSS) - Stored in GitHub repository azuracast/azuracast prior to 0.18. Rated medium severity (CVSS
Remote code execution in AzuraCast ≤0.23.8 is reachable by any authenticated station manager due to a serialization grou
Unauthenticated HTTP requests to AzuraCast 0.23.1's internal sftpgo integration endpoints (/api/internal/sftp-auth and /
Exploit-DB