Executive brief
AzuraCast is a web-based radio station management platform that controls broadcasting infrastructure including Icecast/Shoutcast audio servers. A broken access control vulnerability allows staff members with only read-only permissions to retrieve plaintext admin passwords for the audio servers, which they can then use to access the server's admin panel and manage live broadcasts without proper authorization.
Technical details
The GET /api/station/{id}/vue/profile endpoint in AzuraCast before 0.23.8 performs insufficient permission checks, applying only View-level permission middleware instead of requiring Broadcasting permission. An authenticated attacker with StationPermissions::View can request this endpoint and receive plaintext Icecast/Shoutcast admin, source, and relay passwords in the JSON response, then use the leaked admin credentials to access the audio server's admin interface (e.g., /admin/stats) for unauthorized control actions.
Affected products
- AzuraCast AzuraCast before 0.23.8
Timeline
- 2026-08-07: disclosed
- 2026-09-27: patched