CVE-2026-121432
Deferred Deferred - Pending Action

CRLF Injection in AzuraCast Prior to 0.24.0

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: VulnCheck

Description
AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay display_name values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and TitleN= lines into the public playlist.pls to redirect guest listeners to attacker-controlled streams under the victim station's name.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121432
EUVD
EUVD-2026-115854

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
AzuraCast AzuraCast 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-121432 is a CRLF injection vulnerability in AzuraCast versions before 0.24.0. Low-privilege station users with specific permissions can inject CR/LF characters into the display_name of mounts or remote relays. This causes additional malicious lines to appear in the public playlist file, redirecting listeners to attacker-controlled streams while showing the victim station's name.

Detection Guidance

Check AzuraCast logs for unusual playlist.pls requests or entries with CR/LF characters in display_name fields. Inspect network traffic for redirects to unexpected streams from public playlist endpoints.

Impact Analysis

Attackers can trick listeners into connecting to malicious streams by injecting fake playlist entries. This may lead to phishing attacks, malware distribution, or unauthorized content delivery under the victim station's name. Media players that follow the injected entries are required for exploitation.

Mitigation Strategies

Upgrade AzuraCast to version 0.24.0 or later. Disable public playlist pages or set is_visible_on_public_pages to false for affected mounts. Sanitize display_name inputs to strip CR/LF characters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121432. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...