CVE-2023-51442

Navidrome vulnerability CVE-2023-51442 affects the subsonic authentication endpoint. A JWT signed with the hardcoded key "not so secret" can bypass authentication on instances that have never been restarted, potentially granting access to existing user accounts via the /rest/ endpoint. The issue ...

CVE-2023-51442 Authentication bypass vulnerability in navidrome's subsonic endpoint

Navidrome is an open source web-based music collection server and streamer. A security vulnerability has been identified in navidrome's subsonic endpoint, allowing for authentication bypass. This exploit enables unauthorized access to any known account by utilizing a JSON Web Token JWT signed wit...

CVE-2023-51442: Improper Authentication

Navidrome is an open source web-based music collection server and streamer. A security vulnerability has been identified in navidrome's subsonic endpoint, allowing for authentication bypass. This exploit enables unauthorized access to any known account by utilizing a JSON Web Token JWT signed wit...

GHSA-WQ59-4Q6R-635R Authentication bypass vulnerability in navidrome's subsonic endpoint

Summary A security vulnerability has been identified in navidrome's subsonic endpoint, allowing for authentication bypass. This exploit enables unauthorized access to any known account by utilizing a JSON Web Token JWT signed with the key "not so secret". The vulnerability can only be exploited o...

Authentication bypass vulnerability in navidrome's subsonic endpoint

Summary A security vulnerability has been identified in navidrome's subsonic endpoint, allowing for authentication bypass. This exploit enables unauthorized access to any known account by utilizing a JSON Web Token JWT signed with the key "not so secret". The vulnerability can only be exploited o...

PT-2023-31832 · Navidrome · Navidrome

Name of the Vulnerable Software and Affected Versions: Navidrome versions prior to 0.50.2 Description: A security issue has been identified in Navidrome's subsonic endpoint, allowing for authentication bypass. This exploit enables unauthorized access to any known account by utilizing a JSON Web...

Subsonic Server Side Request Forgery (CVE-2017-9355)

A vulnerability exists in Subsonic. Successful exploitation of this vulnerability could allow a remote attacker to damage users system...

CVE-2021-21399

Ampache is a web based audio/video streaming application and file manager. Versions prior to 4.4.1 allow unauthenticated access to Ampache using the subsonic API. To successfully make the attack you must use a username that is not part of the site to bypass the auth checks. For more details and...

Design/Logic Flaw

Ampache is a web based audio/video streaming application and file manager. Versions prior to 4.4.1 allow unauthenticated access to Ampache using the subsonic API. To successfully make the attack you must use a username that is not part of the site to bypass the auth checks. For more details and...

UBUNTU-CVE-2021-21399

Ampache is a web based audio/video streaming application and file manager. Versions prior to 4.4.1 allow unauthenticated access to Ampache using the subsonic API. To successfully make the attack you must use a username that is not part of the site to bypass the auth checks. For more details and...

CVE-2021-21399 Unauthenticated SubSonic backend access in Ampache

Ampache is a web based audio/video streaming application and file manager. Versions prior to 4.4.1 allow unauthenticated access to Ampache using the subsonic API. To successfully make the attack you must use a username that is not part of the site to bypass the auth checks. For more details and...

CVE-2021-21399: Improper Access Control

Ampache is a web based audio/video streaming application and file manager. Versions prior to 4.4.1 allow unauthenticated access to Ampache using the subsonic API. To successfully make the attack you must use a username that is not part of the site to bypass the auth checks. For more details and...

PT-2021-14476 · Ampache · Ampache

Name of the Vulnerable Software and Affected Versions: Ampache versions prior to 4.4.1 Description: The issue allows unauthenticated access to Ampache using the subsonic API. To exploit this, an attacker must use a username that is not part of the site to bypass the auth checks. Recommendations:...

CVE-2018-20228

Subsonic V6.1.5 allows internetRadioSettings.view streamUrl CSRF, with resultant SSRF...

CVE-2018-20228

Subsonic V6.1.5 allows internetRadioSettings.view streamUrl CSRF, with resultant SSRF...

Design/Logic Flaw

Subsonic V6.1.5 allows internetRadioSettings.view streamUrl CSRF, with resultant SSRF...

CVE-2018-20228

Subsonic V6.1.5 allows internetRadioSettings.view streamUrl CSRF, with resultant SSRF...

CVE-2018-20228

CVE-2018-20228 concerns Subsonic V6.1.5 where an issue in internetRadioSettings.view streamUrl enables CSRF, enabling Server-Side Request Forgery (SSRF). Public description confirms the vulnerability affecting Subsonic 6.1.5 and identifies CSRF and SSRF as the outcomes. NVD data lists CVSS scores...

CVE-2018-20228: Cross-Site Request Forgery (CSRF)

Subsonic V6.1.5 allows internetRadioSettings.view streamUrl CSRF, with resultant SSRF...

PT-2018-15296

Name of the Vulnerable Software and Affected Versions Subsonic version 6.1.5 Description The issue allows for a CSRF attack that can lead to a Server-Side Request Forgery SSRF when accessing the streamUrl in internetRadioSettings.view. Recommendations For Subsonic version 6.1.5, update to a newer...