CVE-2026-121428
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
Nov 03, 2026
Vendor
unknown
Description
AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program that executes OS commands as root when configuration regenerates.