CVE-2026-42606

AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the ApplyXForwarded middleware unconditionally trusts the client-supplied X-Forwarded-Host HTTP header with no trusted proxy allowlist. An unauthenticated attacker can poison the password reset URL sent to any user by injecting this header when triggering the forgot-password flow. When the victim clicks the poisoned link, their reset token is exfiltrated to the attacker's server. The attacker then uses the token on the real instance to reset the victim's password and destroy their 2FA configuration, achieving full account takeover. This issue has been patched in version 0.23.6.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/AzuraCast/AzuraCast/commit/7c622a18b451533de317e53862b1f84acf4efd85	Patch
https://github.com/AzuraCast/AzuraCast/releases/tag/0.23.6	Product
https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-gv7r-3mr9-h5x8	Exploit Mitigation Vendor Advisory
https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-gv7r-3mr9-h5x8	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:azuracast:azuracast:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-09 20:16

Updated : 2026-07-24 19:10

NVD link : CVE-2026-42606

Mitre link : CVE-2026-42606

CVE.ORG link : CVE-2026-42606

JSON object : View

Products Affected

azuracast

azuracast

CWE

CWE-640

Weak Password Recovery Mechanism for Forgotten Password

{"id": "CVE-2026-42606", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42606", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-12T18:00:04.891283Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "AzuraCast", "product": "AzuraCast", "versions": [{"status": "affected", "version": "< 0.23.6"}]}]}], "published": "2026-05-09T20:16:30.170", "references": [{"url": "https://github.com/AzuraCast/AzuraCast/commit/7c622a18b451533de317e53862b1f84acf4efd85", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/AzuraCast/AzuraCast/releases/tag/0.23.6", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-gv7r-3mr9-h5x8", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-gv7r-3mr9-h5x8", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-640"}]}], "descriptions": [{"lang": "en", "value": "AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the ApplyXForwarded middleware unconditionally trusts the client-supplied X-Forwarded-Host HTTP header with no trusted proxy allowlist. An unauthenticated attacker can poison the password reset URL sent to any user by injecting this header when triggering the forgot-password flow. When the victim clicks the poisoned link, their reset token is exfiltrated to the attacker's server. The attacker then uses the token on the real instance to reset the victim's password and destroy their 2FA configuration, achieving full account takeover. This issue has been patched in version 0.23.6."}, {"lang": "es", "value": "AzuraCast es una suite de gesti\u00f3n de radio web todo en uno, autoalojada. Antes de la versi\u00f3n 0.23.6, el middleware ApplyXForwarded conf\u00eda incondicionalmente en el encabezado HTTP X-Forwarded-Host proporcionado por el cliente, sin una lista de permitidos de proxies de confianza. Un atacante no autenticado puede envenenar la URL de restablecimiento de contrase\u00f1a enviada a cualquier usuario inyectando este encabezado al activar el flujo de 'olvid\u00e9 mi contrase\u00f1a'. Cuando la v\u00edctima hace clic en el enlace envenenado, su token de restablecimiento es exfiltrado al servidor del atacante. El atacante luego usa el token en la instancia real para restablecer la contrase\u00f1a de la v\u00edctima y destruir su configuraci\u00f3n de 2FA, logrando una toma de control total de la cuenta. Este problema ha sido parcheado en la versi\u00f3n 0.23.6."}], "lastModified": "2026-07-24T19:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:azuracast:azuracast:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "67379BAE-08E4-4D21-AFAD-27A6CD3F9DEC", "versionEndExcluding": "0.23.6"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}