---
id: "CVE-2026-121427"
kind: "vulnerability"
aliases: ["CVE-2026-121427"]
title: "AzuraCast: station profile users can hijack Shoutcast frontend config"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["azuracast", "package", "radio", "self-hosted", "shoutcast"]
not_affected_if: ["admin-only-profile-edits"]
published_at: "2026-11-03T15:17:33+00:00"
first_seen_at: "2026-11-03T15:21:59+00:00"
updated_at: "2026-11-03T15:22:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121427", "first_seen_at": "2026-11-03T15:21:59+00:00"}]
---

# AzuraCast: station profile users can hijack Shoutcast frontend config

AzuraCast through 0.23.8 does not strip a custom Shoutcast config field for users who lack broadcasting permission, and writes it verbatim into the Shoutcast sc_serv.conf file. A user with only the station profile permission can override the admin and source passwords and the port, or inject extra directives through newlines, taking over the station's Shoutcast frontend.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the AzuraCast version with `docker exec -it azuracast azuracast_cli --version` or the admin panel footer; unknown if the sources do not give the exact command.
- Look for the `frontend_config.custom_config` field in station profile settings for non-admin users.
- Review `sc_serv.conf` for unexpected `adminpassword`, `password` or `portbase` lines.

## Fix

- AzuraCast: versions after `0.23.8` are affected; the sources do not name a fixed version.

## Timeline

- 2026-11-03T15:21:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121427

## Documents

- [advisory] Vendor advisory: github.com https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-2wcv-vv3g-g86q
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/azuracast-through-0.23.8-config-injection-via-frontend-config-custom-config

## From the sources

AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast sc_serv.conf file. An authenticated user with only the Manage station profile permission can override adminpassword, password, and portbase, or inject arbitrary directives via newlines in keys, hijacking the station's Shoutcast frontend.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_