{"action":"Upgrade azuracast/azuracast to 0.23.6 or later.","affected":[{"fixed":"0.23.6","introduced":"0"}],"component":"azuracast/azuracast","cve_ids":["CVE-2026-42606"],"ecosystem":"Packagist","epss":0.00476,"exploited":false,"fixed_versions":["0.23.6"],"ghsa_id":"GHSA-gv7r-3mr9-h5x8","id":"tcs_01M5KF33HS0A69P8GPA99A6KVR","modified_at":"2026-05-13T13:53:09.098522Z","published_at":"2026-05-04T21:17:45Z","references":["https://osv.dev/vulnerability/GHSA-gv7r-3mr9-h5x8","https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-gv7r-3mr9-h5x8","https://nvd.nist.gov/vuln/detail/CVE-2026-42606","https://github.com/AzuraCast/AzuraCast/commit/7c622a18b451533de317e53862b1f84acf4efd85","https://github.com/AzuraCast/AzuraCast","https://github.com/AzuraCast/AzuraCast/releases/tag/0.23.6"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-gv7r-3mr9-h5x8","url":"https://osv.dev/vulnerability/GHSA-gv7r-3mr9-h5x8"}],"summary":"AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA Bypass"}