Live › vulnerability › CVE-2026-121427
AzuraCast through 0.23.8 does not strip a custom Shoutcast config field for users who lack broadcasting permission, and writes it verbatim into the Shoutcast sc_serv.conf file. A user with only the station profile permission can override the admin and source passwords and the port, or inject extra directives through newlines, taking over the station's Shoutcast frontend.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Teams running self-hosted AzuraCast with station users who hold only the Manage station profile permission can be affected. Installations where only fully trusted administrators can edit station profiles are less exposed. The sources do not state a fixed release.
No product ranges from the sources yet.
docker exec -it azuracast azuracast_cli --version or the admin panel footer; unknown if the sources do not give the exact command.frontend_config.custom_config field in station profile settings for non-admin users.sc_serv.conf for unexpected adminpassword, password or portbase lines.0.23.8 are affected; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast sc_serv.conf file. An authenticated user with only the Manage station profile permission can override adminpassword, password, and portbase, or inject arbitrary directives via newlines in keys, hijacking the station's Shoutcast frontend.
This page as .md · .json · in your agent: get_signal("CVE-2026-121427")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.