https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 06:55:59 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-317411 EUVD-2026-317411 https://cve.radiocsirt.org/vuln/euvd-2026-317411 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42606 <p>AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the ApplyXForwarded middleware unconditionally trusts the client-supplied X-Forwarded-Host HTTP header with no trusted proxy allowlist. An unauthenticated attacker can poison the password reset URL sent to any user by injecting this header when triggering the forgot-password flow. When the victim clicks the poisoned link, their reset token is exfiltrated to the attacker&#39;s server. The attacker then uses the token on the real instance to reset the victim&#39;s password and destroy their 2FA configuration, achieving full account takeover. This issue has been patched in version 0.23.6.</p> <p>AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the ApplyXForwarded middleware unconditionally trusts the client-supplied X-Forwarded-Host HTTP header with no trusted proxy allowlist. An unauthenticated attacker can poison the password reset URL sent to any user by injecting this header when triggering the forgot-password flow. When the victim clicks the poisoned link, their reset token is exfiltrated to the attacker&#39;s server. The attacker then uses the token on the real instance to reset the victim&#39;s password and destroy their 2FA configuration, achieving full account takeover. This issue has been patched in version 0.23.6.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42606 https://cve.radiocsirt.org/vuln/ghsa-gv7r-3mr9-h5x8 <p><strong>Affected:</strong> Packagist: azuracast/azuracast</p> <p>## Summary</p> <p>The `ApplyXForwarded` middleware unconditionally trusts the client-supplied `X-Forwarded-Host` HTTP header with no trusted proxy allowlist. An unauthenticated attacker can poison the password reset URL sent to any user by injecting this header when triggering the forgot-password flow. When the victim clicks the poisoned link, their reset token is exfiltrated to the attacker&#39;s server. The attacker then uses the token on the real instance to reset the victim&#39;s password and destroy their 2FA configuration, achieving full account takeover.</p> <p>## Details</p> <p>### Root Cause 1: Unconditional X-Forwarded-Host Trust</p> <p>`backend/src/Middleware/ApplyXForwarded.php:35-40`: ```php if ($request-&gt;hasHeader(&#39;X-Forwarded-Host&#39;)) { $hasXForwardedHeader = true; $xfHost = Types::stringOrNull($request-&gt;getHeaderLine(&#39;X-Forwarded-Host&#39;), true); if (null !== $xfHost) { $uri = $uri-&gt;withHost($xfHost); } } ```</p> <p>There is no validation that the request originates from a trusted reverse proxy. Any direct client can set this header and it will be accepted.</p> <p>In the default Docker deployment, nginx&#39;s PHP location block (`util/docker/web/nginx/azuracast.conf.tmpl:150-171`) uses `fastcgi_pass` with `include fastcgi_params`. Standard nginx behavior passes all client HTTP headers through to PHP-FPM as `HTTP_*` parameters. The `proxy_params.conf` file — which explicitly sets `X-Forwarded-For`, `X-Forwarded-Proto`, and `X-Forwarded-Port` — only applies to `proxy_pass` directives (we…</p> <p><strong>Affected:</strong> Packagist: azuracast/azuracast</p> <p>## Summary</p> <p>The `ApplyXForwarded` middleware unconditionally trusts the client-supplied `X-Forwarded-Host` HTTP header with no trusted proxy allowlist. An unauthenticated attacker can poison the password reset URL sent to any user by injecting this header when triggering the forgot-password flow. When the victim clicks the poisoned link, their reset token is exfiltrated to the attacker&#39;s server. The attacker then uses the token on the real instance to reset the victim&#39;s password and destroy their 2FA configuration, achieving full account takeover.</p> <p>## Details</p> <p>### Root Cause 1: Unconditional X-Forwarded-Host Trust</p> <p>`backend/src/Middleware/ApplyXForwarded.php:35-40`: ```php if ($request-&gt;hasHeader(&#39;X-Forwarded-Host&#39;)) { $hasXForwardedHeader = true; $xfHost = Types::stringOrNull($request-&gt;getHeaderLine(&#39;X-Forwarded-Host&#39;), true); if (null !== $xfHost) { $uri = $uri-&gt;withHost($xfHost); } } ```</p> <p>There is no validation that the request originates from a trusted reverse proxy. Any direct client can set this header and it will be accepted.</p> <p>In the default Docker deployment, nginx&#39;s PHP location block (`util/docker/web/nginx/azuracast.conf.tmpl:150-171`) uses `fastcgi_pass` with `include fastcgi_params`. Standard nginx behavior passes all client HTTP headers through to PHP-FPM as `HTTP_*` parameters. The `proxy_params.conf` file — which explicitly sets `X-Forwarded-For`, `X-Forwarded-Proto`, and `X-Forwarded-Port` — only applies to `proxy_pass` directives (we…</p> https://cve.radiocsirt.org/vuln/ghsa-gv7r-3mr9-h5x8