Product
CVE-2026-76836 - Improper Access Control in AzuraCast Leads to RCE
2 TTPs 1 CVEAn improper access control vulnerability in AzuraCast allows low-privileged users to inject arbitrary commands into Liquidsoap configurations, leading to remote code execution upon backend restart.
AzuraCast Account Takeover via X-Forwarded-Host Poisoning
2 rules 3 TTPs 2 IOCsAzuraCast is vulnerable to password reset poisoning due to unconditionally trusting the X-Forwarded-Host header, allowing an attacker to inject a malicious host into the password reset URL, exfiltrate the reset token, reset the victim's password, and disable 2FA, leading to account takeover.
AzuraCast Account Takeover via X-Forwarded-Host Poisoning
2 rules 3 TTPs 2 IOCsAzuraCast is vulnerable to password reset poisoning due to unconditionally trusting the X-Forwarded-Host header, allowing an attacker to inject a malicious host into the password reset URL, exfiltrate the reset token, reset the victim's password, and disable 2FA, leading to account takeover.