Skip to content
Threat Feed
Subscribe
high advisory PoC

AzuraCast: Configuration injection and privilege escalation (CVE-2026-121427)

AzuraCast versions 0.23.8 and earlier contain an authorization bypass vulnerability allowing users with limited permissions to inject arbitrary directives into the Shoutcast configuration file.

CVE search metadata

CVE search record: CVE-2026-121427. Severity: high. CVSS: 7.5. KEV: no. Product: AzuraCast (<= 0.23.8). Brief: AzuraCast: Configuration injection and privilege escalation (CVE-2026-121427). Brief link: https://feed.craftedsignal.io/briefs/2026-11-azuracast-config-injection/

CVE search record: CVE-2026-121429. Severity: high. CVSS: 8.8. KEV: no. Product: AzuraCast (<= 0.23.8). Brief: AzuraCast: Configuration injection and privilege escalation (CVE-2026-121427). Brief link: https://feed.craftedsignal.io/briefs/2026-11-azuracast-config-injection/

Triage facts

Revision 2
Applicability
AzuraCast (<= 0.23.8)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
3 public sources
Freshness
Revision 2Nov 3, 16:15 UTC
Vulnerabilities
2 CVEs
Source quality
A1Likely
Revision history 1 entry · Revision 2
  1. Revision 2

    poc_available

    Changed: claim_state, has_poc, lastmod, poc_references, references, updates

    Sources: 1

AzuraCast versions 0.23.8 and earlier are vulnerable to a configuration injection attack via the /station/{id}/profile/edit endpoint. The application fails to properly validate permissions or sanitize input for the frontend_config.custom_config field. Authenticated users with the Manage station profile permission can inject arbitrary directives into the Shoutcast sc_serv.conf file, enabling them to override critical security settings such as adminpassword and portbase.

Impact

An attacker can hijack the Shoutcast frontend service by overriding authentication credentials and service configuration parameters, leading to a complete compromise of the station broadcasting service.

Recommendation

  • Upgrade AzuraCast to a version later than 0.23.8 once a patch is available.
  • Review existing permissions for all users assigned the Manage station profile role to identify unauthorized configuration changes.
  • Monitor logs for HTTP PUT requests to /station/*/profile/edit that include unusual JSON structures in the custom_config field.

Immediate actions

Restrict "Profile" permissions for non-administrative users in AzuraCast to mitigate unauthorized configuration changes

IT Operations 24h

Threat Hunt

Identify authenticated users modifying station profiles with potential malicious configuration payloads

T1068 high medium confidence hunt now

Data: Web server access logs or application audit logs for PUT requests to /station/*/profile/edit

Audit AzuraCast application logs for configuration changes involving the stereo_tool_configuration_path or stereo_tool_license_key fields

T1059 medium medium confidence hunt now

Data: AzuraCast application activity logs

Mitigations

Audit user roles to ensure only trusted administrators hold Manage station profile permissions until patching is completed

immediate IT Operations

CVE-2026-121427

Upgrade AzuraCast to a version newer than 0.23.8

immediate IT Operations

CVE-2026-121429