Vulnerability · Published Sep 27, 2026 · Assigned by VulnCheck

CVE-2026-100853AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass

Medium 5.9

In plain English

A medium-severity missing authorization in AzuraCast from AzuraCast. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.3%top 75.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly requesting media via the download endpoint using valid media identifiers, exposing private or restricted audio content.

Affected products (as reported)

Vendor	Product	Versions
AzuraCast	AzuraCast	0 – before 0.23.8

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-q9cc-mp52-vrp9) vendor-advisory
VulnCheck Advisory: AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass third-party-advisory