CVE-2026-42606

Descripción

AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the ApplyXForwarded middleware unconditionally trusts the client-supplied X-Forwarded-Host HTTP header with no trusted proxy allowlist. An unauthenticated attacker can poison the password reset URL sent to any user by injecting this header when triggering the forgot-password flow. When the victim clicks the poisoned link, their reset token is exfiltrated to the attacker-s server. The attacker then uses the token on the real instance to reset the victim-s password and destroy their 2FA configuration, achieving full account takeover. This issue has been patched in version 0.23.6.