Executive brief
AzuraCast, a web-based radio management platform, is vulnerable to a flaw that allows attackers to take over user accounts. By sending a specially crafted request, an attacker can trick the system into sending a legitimate-looking password reset email that actually directs the user to a malicious website. If the user clicks the link, the attacker can steal their login credentials and bypass two-factor authentication (2FA) to gain full control of the account.
Technical details
AzuraCast prior to version 0.23.6 contains a password reset poisoning vulnerability. The 'ApplyXForwarded' middleware unconditionally trusts the client-supplied 'X-Forwarded-Host' HTTP header without validating it against a trusted proxy allowlist. An unauthenticated attacker can trigger a password reset for a target user while injecting a malicious host in this header. The system then generates an absolute reset URL using the attacker's host and emails it to the victim. If the victim clicks the link, the reset token is exfiltrated to the attacker's server. The attacker can then use this token on the legitimate instance to change the password; notably, the application also wipes the user's 2FA secret during this process, resulting in a complete account takeover. This has been patched in version 0.23.6 by ensuring the configured base URL is used for reset emails.
Affected products
- AzuraCast AzuraCast < 0.23.6
Timeline
- 2026-04-23: advisory: GitHub Security Advisory published
- 2026-04-24: patched: Version 0.23.6 released
- 2026-05-09: disclosed: CVE-2026-42606 published