Read the docs
TI-2026-84309 Aliases CVE-2026-121427GHSA-jv23-j2cr-92x9

Config injection in AzuraCast via station frontend custom config

Priority LOW 38CWE-15Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

AzuraCast through 0.23.8 fails to strip frontend_config.custom_config for users without the Manage station broadcasting permission, so the stored JSON is written verbatim into the Shoutcast sc_serv.conf file as key=value lines. This flaw is classified as CWE-15, external control of a system or configuration setting. An authenticated user with only the Manage station profile permission can override adminpassword, password, and portbase, or inject arbitrary directives through newlines in keys, hijacking the station's Shoutcast frontend.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast sc_serv.conf file. An authenticated user with only the Manage station profile permission can override adminpassword, password, and portbase, or inject arbitrary directives via newlines in keys, hijacking the station's Shoutcast frontend.

Why it matters now

EPSS 0.00322 25th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AzuraCastAzuraCastup to 0.23.8—No fix listedCNA
  • AzuraCast VendorAzuraCast Affected up to 0.23.8 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:azuracast:azuracast:*:*:*:*:*:*:*:*——AzuraCast
  • cpe:2.3:a:azuracast:azuracast:*:*:*:*:*:*:*:* Versions — — ·AzuraCast

Remediation

The sources list no fixed version for AzuraCast.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-121427
  2. 2026-11-03 Alias added: GHSA-jv23-j2cr-92x9
  3. 2026-11-05 Priority changed: MEDIUM → LOW

References

Advisory 1

  • TI-2023-02372 Improper Restriction of Excessive Authentication Attempts in azuracast/azuracast CVSS 3.1CRITICAL 9.8
  • TI-2026-64985 AzuraCast before 0.23.8 DQL Injection via sortOrder CVSS 4.0HIGH 8.7
  • TI-2026-64994 AzuraCast before 0.23.6 Code Injection via Remote Relay Password CVSS 4.0HIGH 8.7
  • TI-2026-64990 AzuraCast before 0.23.8 Command Injection via Streamer Username CVSS 4.0HIGH 8.7
  • TI-2026-53672 AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass CVSS 4.0HIGH 8.7
  • TI-2026-30886 AzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA Bypass CVSS 3.1HIGH 8.8
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences