CVE-2026-121427: AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config
AzuraCast through 0.23.8 fails to remove frontendconfig.customconfig in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast scserv.conf file. An authenticated user with only the Manage station profile permission can override adminpassword, password, and portbase, or inject arbitrary directives via newlines in keys, hijacking the station's Shoutcast frontend.
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated user who has the Manage station profile permission can exploit it even if they do not have the Manage station broadcasting permission. No higher privilege is required.
What configuration can an attacker change?
The attacker can override Shoutcast settings including adminpassword, password, and portbase. By placing newlines in JSON keys, they can also inject arbitrary directives into the generated sc_serv.conf file.
Does exploitation require access to a separate management endpoint?
Exploitation uses the PUT /station/{id}/profile/edit endpoint. The vulnerable behavior occurs because frontend_config.custom_config is not removed for users lacking the Manage station broadcasting permission.
How can I determine whether a station may have been modified?
Inspect the station's generated Shoutcast sc_serv.conf file for unexpected key=value entries, especially changed adminpassword, password, portbase, or unrecognized directives. Review profile-edit activity by users who have Manage station profile permission but lack Manage station broadcasting permission.