CRLF Injection Vulnerability in AzuraCast Streaming Software

CVE-2026-121432

What is CVE-2026-121432?

AzuraCast, an open-source web radio management platform, is susceptible to a CRLF injection vulnerability. This flaw allows low-privilege station users with specific permissions to inject harmful playlist entries into the public playlist.pls file. By embedding CR/LF sequences in mount or remote relay display_name values, attackers can redirect listeners to malicious streams disguised under the victim station's branding. This security issue poses significant risks to the integrity of online radio operations and listener safety.

References