Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the ApplyXForwarded middleware unconditionally trusts the client-supplied X-Forwarded-Host HTTP header with no trusted proxy allowlist. An unauthenticated attacker can poison the password reset URL sent to any user by injecting this header when triggering the forgot-password flow. When the victim clicks the poisoned link, their reset token is exfiltrated to the attacker's server. The attacker then uses the token on the real instance to reset the victim's password and destroy their 2FA configuration, achieving full account takeover. This issue has been patched in version 0.23.6.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-09 | 1 | Disclosure1 |
| 2026-05-10 | 1 | Patch1 |
CVE-2026-42606 AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the ApplyXForwarded middleware unconditionally trusts the client-supplied … https://www.cve.org/CVERecord?id=CVE-2026-42606
Post summary
CVE-2026-42606 exposes AzuraCast’s ApplyXForwarded middleware to potential exploitation by untrusted input; the vendor recommends updating to version 0.23.6 to mitigate.
CVE-2026-42606 HTTP Header Injection Leading to Account Takeover in AzuraCast Before 0.23.6 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42606
Post summary
A new CVE (CVE-2026-42606) identifies an HTTP header injection flaw in AzuraCast that allows account takeover before version 0.23.6, but no PoC, exploit, patch, or active exploitation evidence is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | azuracast | azuracast | - | - | - |