CVE-2026-121428High· 8.8▾ TwilightAzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.7%
AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program that executes OS commands as root when configuration regenerates.
AzuraCast <= 0.23.8Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-100857High· 8.0AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString() method that fails to sanitize Liquidsoap string interpolation sequences, allowing authenticated users with Media or Profile permissions …
CVE-2026-100856High· 8.8AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString
CVE-2026-121432Low· 3.5AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist
CVE-2026-121429High· 8.8AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()
CVE-2026-121433Medium· 5.4AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export
CVE-2026-121430Medium· 5.4AzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints