CVE-2024-56362highCWE-312

CVE-2024-56362: falha de alta gravidade em navidrome

Navidrome Stores JWT Secret in Plaintext in navidrome.db

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar navidrome+ Monitorar github.com/navidrome/navidrome

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.2%
Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. This vulnerability is fixed in 0.54.1.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
navidrome · navidrome
CVEs relacionadas — navidrome

No mesmo produto, das mais perigosas para as menos.

CVE-2024-47062CRITICALMultiple SQL Injections and ORM Leak in navidromeEPSS 4.5%CVE-2025-27112MEDIUMNavidrome has authentication bypass in Subsonic API with non-existent usernameEPSS 1.0%CVE-2023-51442HIGHAuthentication bypass vulnerability in navidrome's subsonic endpointEPSS 0.7%CVE-2025-48948HIGHNavidrome Transcoding Permission Bypass Vulnerability ReportEPSS 0.5%CVE-2025-48949HIGHNavidrome allows SQL Injection via role parameterEPSS 0.5%CVE-2026-25579CRITICALNavidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpointsEPSS 0.5%