CVE-2026-121428

AzuraCast versions through 0.23.8 are vulnerable to Remote Code Execution (RCE) due to a Supervisor configuration injection flaw in the station timezone field. Authenticated station managers can exploit the profile edit API by submitting a timezone string containing newlines. This allows the inje...

CVE-2026-121428 AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone

AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program...