High priorityDisclosed

Advisory · CVE-2026-100847

Unauthenticated DQL injection leaks AzuraCast credentials

AzuraCast's sortOrder API parameter accepts arbitrary DQL expressions with no authentication, exposing user credentials and station settings.

Advisory published September 27, 2026Independent summary
Vendor
AzuraCast
Product
AzuraCast
Identifier / CWE
CVE-2026-100847
CWE-89
Action timing
Immediate
ELI5

Explain it like I’m five

AzuraCast lets strangers rearrange a list however they ask, no password needed. But the request box also accepts database commands, so a stranger can ask it to hand over the keys instead.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Unauthenticated request

    An attacker sends an unauthenticated request to a searchable list API endpoint.

  2. 02sortOrder injected

    The sortOrder parameter carries arbitrary DQL expressions, which AbstractSearchableListAction passes into the query unsanitized.

  3. 03Database answers

    The injected expressions extract sensitive database information, including user credentials and station settings.

  4. 04Credentials harvested

    The attacker collects valid credentials for further attacks against the station.

What happened

AzuraCast before 0.23.8 (CVE-2026-100847, CVSS 8.7) contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitrary DQL expressions through the sortOrder parameter with no authentication required.

The injected expressions extract sensitive database information including user credentials and station settings. Version 0.23.8 fixes the issue.

What to do

  1. Upgrade AzuraCast to 0.23.8 or later.
  2. Rotate all user passwords, API keys, and station credentials; assume any credential stored in the database is exposed.
  3. Review API and database logs for unusual sortOrder values or bulk extraction patterns.
  4. Check for unauthorized admin or station-user accounts created with stolen credentials.

Management note

Unauthenticated injection into a credential store is a worst-case data exposure pattern. Patch and rotate in the same window; patching alone leaves any harvested credentials valid.