CVE-2023-51442 Authentication bypass vulnerability in navidrome's subsonic endpoint

Navidrome is an open source web-based music collection server and streamer. A security vulnerability has been identified in navidrome's subsonic endpoint, allowing for authentication bypass. This exploit enables unauthorized access to any known account by utilizing a JSON Web Token JWT signed wit...

CVE-2023-51442

Navidrome vulnerability CVE-2023-51442 affects the subsonic authentication endpoint. A JWT signed with the hardcoded key "not so secret" can bypass authentication on instances that have never been restarted, potentially granting access to existing user accounts via the /rest/ endpoint. The issue ...

CVE-2023-51442

creationtimestamp| type| source ---|---|--- 2023-12-19 17:47:12+00:00| published-proof-of-concept| https://github.com/navidrome/navidrome/security/advisories/GHSA-wq59-4q6r-635r 2023-12-21 16:28:18+00:00| seen| https://t.me/ctinow/157803 2024-01-04 17:11:30+00:00| seen| https://t.me/ctinow/163112...