PT-2026-37205 · Azuracast · Azuracast

Offset · Published 2026-05-04 · Updated 2026-05-13 · CVE-2026-42606

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.6

Description The ApplyXForwarded middleware unconditionally trusts the client-supplied X-Forwarded-Host HTTP header without a trusted proxy allowlist. An unauthenticated attacker can exploit this by injecting the X-Forwarded-Host header when triggering the forgot-password flow, poisoning the password reset URL sent to a user. If the victim clicks the link, their reset token is exfiltrated to the attacker's server. The attacker can then use this token on the legitimate instance to reset the victim's password and destroy their two-factor authentication (2FA) configuration, resulting in full account takeover.

Recommendations Update to version 0.23.6. As a temporary workaround, restrict access to the ApplyXForwarded middleware or ensure that the X-Forwarded-Host header is stripped or validated by a trusted reverse proxy before reaching the application.

Exploit

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2026-42606

GHSA-GV7R-3MR9-H5X8

Affected Products

Azuracast

References · 10

• 🔥 https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-gv7r-3mr9-h5x8 · Exploit
• https://github.com/AzuraCast/AzuraCast/commit/7c622a18b451533de317e53862b1f84acf4efd85 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42606 · Security Note
• https://osv.dev/vulnerability/GHSA-gv7r-3mr9-h5x8 · Vendor Advisory
• https://github.com/AzuraCast/AzuraCast/releases/tag/0.23.6 · Note
• https://github.com/AzuraCast/AzuraCast · Note
• https://t.me/CVEtracker/53246 · Telegram Post
• https://t.me/cveNotify/163350 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2053218994291630139 · Twitter Post
• https://twitter.com/CVEnew/status/2053559116669321520 · Twitter Post