Authentication bypass vulnerability in navidrome's subsonic endpoint

CVE-2023-51442

What is CVE-2023-51442?

Navidrome, an open-source web-based music collection server, has a vulnerability in its subsonic endpoint which allows for authentication bypass. This flaw permits unauthorized access to user accounts by leveraging a JSON Web Token (JWT) that is poorly secured with the key 'not so secret'. The issue affects Navidrome instances that have never been restarted and do not adequately protect the '/rest/' subsonic endpoint, which is commonly left exposed in standard deployments. Affected instances are now at risk as this vulnerability can easily be exploited if left unchecked. This security issue has been addressed in version 0.50.2.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References