Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck

CVE-2026-121432AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist

Low 3.5

In plain English

A low-severity security flaw in AzuraCast from AzuraCast. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.2%top 91.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay display_name values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and TitleN= lines into the public playlist.pls to redirect guest listeners to attacker-controlled streams under the victim station's name.

Affected products (as reported)

Vendor	Product	Versions
AzuraCast	AzuraCast	0 – before 0.24.0

Weakness: CWE-93 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

References

GitHub Security Advisory (GHSA-cqgx-rqjr-5gf4) vendor-advisory
VulnCheck Advisory: AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist third-party-advisory