High priorityDisclosed

Advisory · CVE-2026-100856

AzuraCast relay passwords carry Liquidsoap code injection

An incomplete sanitization migration in AzuraCast lets users with RemoteRelays permission inject Liquidsoap interpolation syntax into relay passwords for code execution.

Advisory published September 27, 2026Independent summary
Vendor
AzuraCast
Product
AzuraCast
Identifier / CWE
CVE-2026-100856
CWE-94
Action timing
Immediate
ELI5

Explain it like I’m five

AzuraCast tried to switch to a safer way of cleaning up passwords but left a hole halfway through. A user can hide a secret instruction inside a password, and the system runs it.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Malicious password set

    An attacker with RemoteRelays station permission sets a remote relay password containing nested Liquidsoap interpolation syntax.

  2. 02Incomplete migration

    The code moved from the vulnerable cleanUpString method to toRawString only partially, so the injection is not neutralized.

  3. 03Config consumed

    The relay password flows into the generated Liquidsoap station configuration.

  4. 04Code executes

    The injected Liquidsoap code executes in the Liquidsoap process, disclosing internal API keys or disrupting station operation.

What happened

AzuraCast before 0.23.6 (CVE-2026-100856, CVSS 8.8) contains a code injection vulnerability in the remote relay password field. The migration from the vulnerable cleanUpString method to toRawString was incomplete, so attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax.

The injected syntax executes arbitrary code in the Liquidsoap process, disclosing internal API keys or disrupting station operation. Version 0.23.6 fixes the issue.

What to do

  1. Upgrade AzuraCast to 0.23.6 or later.
  2. Audit remote relay passwords and station configs for interpolation syntax such as #{ sequences.
  3. Rotate internal API keys; assume any key on a station touched by this flaw is exposed.
  4. Review Liquidsoap logs for unexpected process activity.

Management note

A half-finished sanitization migration is worse than the old code: it looks fixed in review while the injection still works. Treat the API keys as burned and rotate them with the patch.