Authentication bypass vulnerability in navidrome's subsonic endpoint

CVE-2023-51442

What is CVE-2023-51442?

Navidrome, an open-source web-based music collection server, has a vulnerability in its subsonic endpoint which allows for authentication bypass. This flaw permits unauthorized access to user accounts by leveraging a JSON Web Token (JWT) that is poorly secured with the key 'not so secret'. The issue affects Navidrome instances that have never been restarted and do not adequately protect the '/rest/' subsonic endpoint, which is commonly left exposed in standard deployments. Affected instances are now at risk as this vulnerability can easily be exploited if left unchecked. This security issue has been addressed in version 0.50.2.

References