CVE-2026-121427High· 7.5▾ TwilightAzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Sh…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast sc_serv.conf file. An authenticated user with only the Manage station profile permission can override adminpassword, password, and portbase, or inject arbitrary directives via newlines in keys, hijacking the station's Shoutcast frontend.
AzuraCast <= 0.23.8Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-121428High· 8.8AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone
CVE-2026-121432Low· 3.5AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist
CVE-2026-121429High· 8.8AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()
CVE-2026-121433Medium· 5.4AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export
CVE-2026-121430Medium· 5.4AzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints
CVE-2026-121431Medium· 5.3AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectors