High-Risk CVE-2026-121427 Discovered in AzuraCast Streaming Software

• •CVE-2026-121427 allows unauthorized configuration changes in AzuraCast.
• •Affected versions include AzuraCast up to 0.23.8, primarily impacting self-hosted deployments.
• •Attackers need authenticated access to exploit the vulnerability, but risk remains high.

AzuraCast versions up to 0.23.8 contain a vulnerability (CVE-2026-121427) that allows users with only Manage station profile permissions to inject arbitrary directives into the Shoutcast sc_serv.conf file via the PUT /station/{id}/profile/edit endpoint. This flaw can lead to unauthorized control over the streaming frontend, potentially disrupting broadcasts and exposing sensitive credentials. The vulnerability is classified as high risk due to its ease of exploitation and the potential impact on internet-facing, self-hosted radio-streaming deployments. Attackers need authenticated access to exploit this vulnerability, but the risk remains significant for poorly managed systems. No exploitation in the wild has been confirmed, and the urgency of response should be assessed against live threat intelligence. Users are advised to restrict profile-editing access and monitor for unauthorized changes. A patch is expected to be released to address this issue.