A vulnerability in AzuraCast allows an attacker to poison the password reset link by injecting an unsolicited X-Forwarded-Host HTTP header. The poisoned link exfiltrates the reset token to the attacker, who then resets the victim’s password and removes 2FA, resulting in full account takeover. This is a header manipulation flaw (CWE‑640) that permits unauthorized access without authentication.

The flaw exists in the AzuraCast web radio management suite before version 0.23.6. Any self‑hosted deployment using an earlier release is vulnerable. The issue was fixed in release 0.23.6 and later.

The vulnerability scores a CVSS of 8.1, indicating a high‑severity condition. No EPSS data is available, but the exploit requires only that an attacker can send an HTTP request to the instance during the reset‑password workflow; authentication is not required. The lack of a KEV listing suggests no publicly known exploits yet, yet the attack path is straightforward and could be performed by anyone with network access to the front‑end. Consequently, the risk is medium‑high, with the potential for full compromise of user accounts.