What is GHSA-j79h-v95g-w786?

GHSA-j79h-v95g-w786 is a security advisory published by GitHub Security Advisories with High severity. In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level...

Which CVE IDs does GHSA-j79h-v95g-w786 cover?

GHSA-j79h-v95g-w786 covers the following CVE IDs: CVE-2026-100853. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-j79h-v95g-w786?

GHSA-j79h-v95g-w786 has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

GHSA-j79h-v95g-w786HighCVSS 5.9

In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level...

Vendor

GitHub Security Advisories

Published

September 27, 2026

Last Modified

September 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-100853 →

📋 Description

In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly requesting media via the download endpoint using valid media identifiers, exposing private or restricted audio content.

🔗 References (4)

https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-q9cc-mp52-vrp9
https://nvd.nist.gov/vuln/detail/CVE-2026-100853
https://www.vulncheck.com/advisories/azuracast-before-0.23.8-on-demand-download-endpoint-authorization-bypass
https://github.com/advisories/GHSA-j79h-v95g-w786