CVE-2026-121427— AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config

Quick assessment

Affected

AzuraCast AzuraCast

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

AzuraCast 在 0.23.8 及更早版本中存在安全漏洞：当用户缺乏“管理电台广播”权限时，PUT /station/{id}/profile/edit 接口无法正确移除 frontend_config.custom_config 字段。该接口会将存储的 JSON 内容原样以“键=值”格式写入 Shoutcast 的 sc_serv.conf 配置文件。因此，仅拥有“管理电台资料”权限的已认证用户即可通过此漏洞覆盖 adminpassword、password 和 portbase 等关键参数，或利用键名中的

CVSS 7.5 · High Updated Nov 03, 2026

Possible ATT&CK Techniques 3 AI

T1078 · Valid Accounts T1190 · Exploit Public-Facing Application T1552 · Unsecured Credentials

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config

Source: CVE Program / CVE List V5

Vulnerability Description

AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast sc_serv.conf file. An authenticated user with only the Manage station profile permission can override adminpassword, password, and portbase, or inject arbitrary directives via newlines in keys, hijacking the station's Shoutcast frontend.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

系统设置或配置在外部可控制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
AzuraCast	AzuraCast	0 ~ 0.23.8	-

II. Public POCs for CVE-2026-121427

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121427

请登录查看更多情报信息。

Other References for CVE-2026-121427 (2)

https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-2wcv-vv3g-g86q vendor-advisory
https://www.vulncheck.com/advisories/azuracast-through-0.23.8-config-injection-via-frontend-config-custom-config third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121427

Same Patch Batch · AzuraCast · 2026-11-03 · 7 CVEs total

CVE-2026-121428	8.8 HIGH	AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone
CVE-2026-121429	8.8 HIGH	AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()
CVE-2026-121430	5.4 MEDIUM	AzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints
CVE-2026-121433	5.4 MEDIUM	AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export
CVE-2026-121431	5.3 MEDIUM	AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectors
CVE-2026-121432	3.5 LOW	AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist

IV. Related Vulnerabilities

Same product: AzuraCast

Same vendor: AzuraCast

Same weakness: CWE-15