CVE-2026-121427

AzuraCast versions through 0.23.8 are vulnerable to a config injection flaw within the frontend_config.custom_config parameter during a PUT /station/{id}/profile/edit request. The system fails to strip this configuration from users who lack the Manage station broadcasting permission. Consequently...