CVE-2026-121428

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.9

Description Authenticated station managers can achieve remote code execution by injecting Supervisor configuration via the station timezone field. By submitting a timezone containing newlines to the profile edit API, an attacker can define a new Supervisor program that executes operating system commands with root privileges during configuration regeneration.

Recommendations Update to version 0.23.9 or later. Restrict the use of the timezone field in the profile edit API to prevent the injection of newline characters.