Executive brief
AzuraCast is a web-based radio station management and streaming platform. An authorization bypass in the On-Demand download endpoint allows unauthenticated users to download audio files that station operators intentionally restricted from public access, exposing private, licensed, or unreleased content.
Technical details
The public On-Demand download endpoint (GET /api/station/{station_id}/ondemand/download/{media_id}) fails to verify playlist-level access controls and accepts any valid StationMedia.unique_id without checking whether the media belongs to an On-Demand-enabled playlist. An unauthenticated attacker can bypass object-level authorization by directly requesting media files using known media identifiers, circumventing the station's intended access restrictions that should limit downloads to files in playlists with include_in_on_demand=1.
Affected products
- AzuraCast AzuraCast before 0.23.8
Timeline
- 2026-09-27: disclosed
- 2026-07-07: advisory: GitHub Security Advisory GHSA-q9cc-mp52-vrp9 published