← Vulnerability feed

Vulnerability record · CVE-2026-42606 · published 9 May 2026

CVE-2026-42606: Azuracast weak password recovery vulnerability

Azuracast · Azuracast

AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the ApplyXForwarded middleware unconditionally trusts the client-supplied X-Forwarded-Host HTTP header with no trusted proxy allowlist. An unauthenticated attacker can poison the password reset URL sent to any user by injecting this header when triggering the forgot-password flow. When the victim clicks the poisoned link, their reset token is exfiltrated to the attacker's server. The attacker then uses the token on the real instance to reset the victim's password and destroy their 2FA configuration, achieving full account takeover. This issue has been patched in version 0.23.6.

8.8 CVSS 3.1 High EPSS 0.57% · top 55.1% CWE-640 · Weak password recovery
8.8CVSS 3.1 base score
0.57%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
24 Jul 2026Last modified by NVD

Description

AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the ApplyXForwarded middleware unconditionally trusts the client-supplied X-Forwarded-Host HTTP header with no trusted proxy allowlist. An unauthenticated attacker can poison the password reset URL sent to any user by injecting this header when triggering the forgot-password flow. When the victim clicks the poisoned link, their reset token is exfiltrated to the attacker's server. The attacker then uses the token on the real instance to reset the victim's password and destroy their 2FA configuration, achieving full account takeover. This issue has been patched in version 0.23.6.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/AzuraCast/AzuraCast/commit/7c622a18b451533de317e53862b1f84acf4efd85 Patch
https://github.com/AzuraCast/AzuraCast/releases/tag/0.23.6 Product
https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-gv7r-3mr9-h5x8 ExploitMitigationVendor Advisory
https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-gv7r-3mr9-h5x8 ExploitMitigationVendor Advisory

Track CVE-2026-42606 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-2531Azuracast improper restriction of authentication attempts vulnerabilityImproper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3.EPSS 0.79%8.8CVE-2026-42605Azuracast path traversal vulnerabilityAzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the currentDirectory request parameter in the Flow.js med…EPSS 1.0%4.8CVE-2023-2191Azuracast cross-site scripting vulnerabilityCross-site Scripting (XSS) - Stored in GitHub repository azuracast/azuracast prior to 0.18.EPSS 0.50%3.7CVE-2025-67737Azuracast missing authorization vulnerabilityAzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for internal u…EPSS 0.25%9.8CVE-2023-7028GitLab CE/EE password reset sent to unverified email, enabling account takeoverGitLab CE/EE versions from 16.1 through 16.7 before their fixed releases could deliver account password reset emails to an unverified email address. …KEVEPSS 95%analysed

Source: NIST National Vulnerability Database (record CVE-2026-42606), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.