← Vulnerability feed

Vulnerability record · CVE-2023-2531 · published 5 May 2023

CVE-2023-2531: Azuracast improper restriction of authentication attempts vulnerability

Azuracast · Azuracast

Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3.

9.8 CVSS 3.1 Critical EPSS 0.79% · top 45.6% CWE-307 · Improper restriction of authentication attempts
9.8CVSS 3.1 base score
0.79%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/azuracast/azuracast/commit/bdb23594ad3e0c47c8568ce028a7c244a406cf9d Patch
https://huntr.dev/bounties/20463eb2-0f9d-4ea3-a2c8-93f80e7aca02 ExploitMitigationPatch
https://github.com/azuracast/azuracast/commit/bdb23594ad3e0c47c8568ce028a7c244a406cf9d Patch
https://huntr.dev/bounties/20463eb2-0f9d-4ea3-a2c8-93f80e7aca02 ExploitMitigationPatch

Track CVE-2023-2531 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-42605Azuracast path traversal vulnerabilityAzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the currentDirectory request parameter in the Flow.js med…EPSS 1.0%8.8CVE-2026-42606Azuracast weak password recovery vulnerabilityAzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the ApplyXForwarded middleware unconditionally trusts the…EPSS 0.57%4.8CVE-2023-2191Azuracast cross-site scripting vulnerabilityCross-site Scripting (XSS) - Stored in GitHub repository azuracast/azuracast prior to 0.18.EPSS 0.50%3.7CVE-2025-67737Azuracast missing authorization vulnerabilityAzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for internal u…EPSS 0.25%

Source: NIST National Vulnerability Database (record CVE-2023-2531), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.