CVE-2026-100851
Received Received - Intake

AzuraCast Broken Access Control Exposes Admin Credentials

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. Attackers with View-only access can call this endpoint and receive plaintext frontend credentials in the JSON response, then use the admin password to authenticate to the Icecast admin interface without Broadcasting permission.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-100851
EUVD
EUVD-2026-87837

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
azuracast azuracast to 0.23.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a broken access control issue in AzuraCast versions before 0.23.8. It affects the GET /api/station/{id}/vue/profile endpoint, where authenticated users with only View Station Page permission can read sensitive Icecast/Shoutcast admin, source, and relay passwords. The API does not enforce proper authorization checks, allowing these users to retrieve plaintext credentials that should only be accessible to those with Broadcasting permissions.

Detection Guidance

To detect this vulnerability, check AzuraCast API responses for the /api/station/{id}/vue/profile endpoint. Send a GET request to this endpoint with a user account that only has View Station Page permissions. If the response includes plaintext Icecast/Shoutcast admin, source, or relay passwords, the system is vulnerable.

Impact Analysis

An attacker with View-only access could exploit this to obtain admin passwords for Icecast, gaining unauthorized access to the admin interface. This could allow them to manipulate broadcast settings, steal source credentials, or relay passwords, potentially disrupting broadcasts or intercepting streams. Single-admin setups face lower risk but are still vulnerable.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Exposure of admin or source credentials may result in data breaches, triggering compliance violations, legal penalties, and reputational damage for organizations handling protected information.

Mitigation Strategies

Immediately upgrade AzuraCast to version 0.23.8 or later to patch the broken access control. If upgrading is not possible, restrict access to the /api/station/{id}/vue/profile endpoint by implementing proper authorization checks. Review all user permissions to ensure no unauthorized accounts have access to sensitive credentials.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100851. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart