---
id: CVE-2026-121427
title: AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config
summary: >-
  AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT
  /station/{id}/profile/edit for users lacking the Manage station broadcasting
  permission, and the stored JSON is written verbatim as key=value lines into
  the Sh…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-15
vendor: AzuraCast
product: AzuraCast
affected:
  - AzuraCast <= 0.23.8
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T14:28:22.192Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121427'
references:
  - url: >-
      https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-2wcv-vv3g-g86q
    label: GitHub Security Advisory (GHSA-2wcv-vv3g-g86q)
  - url: >-
      https://www.vulncheck.com/advisories/azuracast-through-0.23.8-config-injection-via-frontend-config-custom-config
    label: >-
      VulnCheck Advisory: AzuraCast through 0.23.8 Config Injection via
      frontend_config.custom_config
tags:
  - cve.org
epss: 0.00322
epssPercentile: 0.25318
ingestedAt: '2026-11-05T19:30:42.967Z'
---

## Overview

AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast sc_serv.conf file. An authenticated user with only the Manage station profile permission can override adminpassword, password, and portbase, or inject arbitrary directives via newlines in keys, hijacking the station's Shoutcast frontend.

## Affected

- `AzuraCast <= 0.23.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.