CVE-2026-121427 in AzuraCast
Summary
by MITRE • 11/03/2026
AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast sc_serv.conf file. An authenticated user with only the Manage station profile permission can override adminpassword, password, and portbase, or inject arbitrary directives via newlines in keys, hijacking the station's Shoutcast frontend.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in AzuraCast versions up to 0.23.8 represents a critical authorization bypass combined with insecure configuration file handling that allows authenticated users to escalate privileges and compromise radio broadcasting infrastructure. The core issue stems from an improper access control mechanism within the PUT /station/{id}/profile/edit endpoint, which fails to enforce strict permission boundaries for specific configuration parameters. Specifically, while standard user roles are restricted from modifying sensitive broadcast settings, the application erroneously processes and persists changes to frontend_config.custom_config even when the requesting user lacks the Manage station broadcasting permission. This oversight creates a direct path for privilege escalation, allowing lower-privileged users to manipulate critical server configurations that should be reserved exclusively for administrators or dedicated broadcasters with elevated rights.
The technical severity of this flaw is significantly amplified by how AzuraCast handles the custom configuration data. Instead of validating and sanitizing the input against a strict schema before applying it to the underlying Shoutcast sc_serv.conf file, the application writes the stored JSON content verbatim as key=value lines into the configuration file. This lack of input validation means that any arbitrary string provided by the user is directly interpreted by the Shoutcast server software without restriction. Consequently, an attacker can inject malicious directives or override existing security settings simply by manipulating the structure and content of the custom config payload sent to the API endpoint. The absence of sanitization for special characters, particularly newlines within keys, further exacerbates the risk by allowing attackers to break out of intended configuration fields and insert entirely new commands into the server's runtime environment.
The operational impact of this vulnerability is severe, as it enables a complete hijacking of the Shoutcast frontend service running on the affected system. By exploiting the ability to write arbitrary directives, an authenticated user with only Manage station profile permissions can override critical authentication parameters such as adminpassword and password, effectively locking out legitimate administrators or gaining unauthorized administrative access themselves. Furthermore, by modifying the portbase parameter, attackers can redirect traffic or interfere with other services running on different ports. The injection of newlines in keys allows for the insertion of arbitrary Shoutcast directives that may lead to denial of service conditions, data exfiltration via log manipulation, or further exploitation depending on the specific capabilities exposed through the custom configuration interface. This effectively transforms a simple profile editing feature into a powerful remote code execution vector within the context of the broadcasting server process.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Escalation due to the unauthorized modification of administrative settings by lower-privileged users. It also strongly correlates with CWE-74 Insecure Neutralization in Files or Directories, specifically regarding special element neutralization failure (Injection), as well as CWE-915 Improper Modification of Dynamically-Determined Object Attributes. In terms of offensive security frameworks, this attack vector maps to the ATT&CK technique T1078 Valid Accounts, where an attacker uses legitimate credentials with insufficient privileges to perform actions outside their intended scope, and potentially T1496 Resource Hijacking if the goal is to use server resources for unauthorized purposes such as cryptocurrency mining or DDoS participation.
Mitigation strategies must address both the immediate code flaw and broader architectural security practices. The primary remediation involves implementing strict role-based access control checks on the PUT /station/{id}/profile/edit endpoint, ensuring that any modification to frontend_config.custom_config is explicitly blocked for users who do not possess the Manage station broadcasting permission. Additionally, input validation must be enforced at both the application and configuration file levels; custom configurations should be parsed against a predefined whitelist of allowed keys and values rather than being written verbatim. Sanitization routines should strip or escape special characters like newlines to prevent injection attacks into the sc_serv.conf structure. Until patches are applied, administrators should restrict API access through network-level controls such as firewalls or reverse proxy rules, limit user permissions to the absolute minimum required for their roles, and monitor server logs for unusual configuration changes originating from non-administrative accounts.