AzuraCast CVE-2026-42606: Unauthenticated Account Takeover Via X-Forwarded-Host Poisoning

title: CVE-2026-42606: AzuraCast Unauthenticated Account Takeover via X-Forwarded-Host Poisoning
id: scw-2026-05-09-ai-1
status: experimental
level: critical
description: |
  Detects the initial exploitation attempt of CVE-2026-42606. An attacker sends a POST request to the AzuraCast password reset endpoint ('/auth/forgot_password') while injecting a malicious domain into the 'X-Forwarded-Host' HTTP header. This header is then used to construct the password reset link sent to the victim. When the victim clicks the link, their reset token is sent to the attacker's controlled host, enabling account takeover. This rule specifically looks for the vulnerable path and the presence of a suspicious 'X-Forwarded-Host' header.
author: SCW Feed Engine (AI-generated)
date: 2026-05-09
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-42606/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/auth/forgot_password'
      cs-method:
          - 'POST'
      # The X-Forwarded-Host header is typically added by proxies, but here it's being abused
      # to inject a malicious host into the password reset URL. We look for a suspicious
      # X-Forwarded-Host that doesn't match the expected host or contains common exfiltration indicators.
      # This requires the webserver logs to capture custom headers like X-Forwarded-Host.
      # NOTE: The exact field name for custom headers can vary between webserver logs (e.g., 'x_forwarded_host').
      # This example assumes a field named 'x_forwarded_host' is available.
      x_forwarded_host|contains:
          - 'attacker-controlled.com'
          - 'evil.example.org'
          - 'localhost.attacker.net'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse