What is CVE-2025-67737?

CVE-2025-67737 is a low-severity vulnerability in Azuracast, classified under Missing Authorization. CVSS score: 3.1/10. Published 2025-12-12.

How severe is CVE-2025-67737?

Low severity. CVSS v3 base score is 3.1 out of 10.

Auth bypass in Azuracast

CVE-2025-67737

AzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for internal use by the SFTP software sftpgo, exposing it to the public-facing HTTP API for AzuraCast in…

Vulnerability class: Broken Access Control

EPSS: 0.002 (10.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.1 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N.

Affected products

Azuracast — versions < 0.23.2

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2025-67737?: CVE-2025-67737 is a low-severity vulnerability in Azuracast, classified under Missing Authorization. CVSS score: 3.1/10. Published 2025-12-12.
How severe is CVE-2025-67737?: Low severity. CVSS v3 base score is 3.1 out of 10.