Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck

CVE-2026-121427AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config

High 7.5

In plain English

A high-severity security flaw in AzuraCast from AzuraCast. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 74.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast sc_serv.conf file. An authenticated user with only the Manage station profile permission can override adminpassword, password, and portbase, or inject arbitrary directives via newlines in keys, hijacking the station's Shoutcast frontend.

Affected products (as reported)

Vendor	Product	Versions
AzuraCast	AzuraCast	0 – through 0.23.8

Weakness: CWE-15 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-2wcv-vv3g-g86q) vendor-advisory
VulnCheck Advisory: AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config third-party-advisory