Medium severity · published Sep 27, 2026
CVE-2026-100853
AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass
5.9
CVSS
0.3%
EPSS
No
On KEV
Description
In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly requesting media via the download endpoint using valid media identifiers, exposing private or restricted audio content.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AZ
AzuraCast · AzuraCast
before 0.23.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-100853
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-100853
vendor-advisory
https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-q9cc-mp52-vrp9
third-party-advisory
https://www.vulncheck.com/advisories/azuracast-before-0.23.8-on-demand-download-endpoint-authorization-bypass
More from AzuraCast
9.8
CVE-2023-2531
Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3
8.8
CVE-2026-100856
AzuraCast before 0.23.6 Code Injection via Remote Relay Password
8.8
CVE-2026-100852
AzuraCast before 0.23.8 Command Injection via Streamer Username
8.8
CVE-2026-76836
AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass
8.8
CVE-2026-42605
AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload