CVE-2026-72605 in Swing Music
Summary
by MITRE • 08/11/2026
A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can register an account and use it to access protected functionality on the server.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability represents a critical authentication bypass flaw in Swing Music 3.0.0 that directly violates fundamental security principles governing user access control. The issue stems from improper authorization enforcement at the application layer where the POST /auth/profile/create endpoint operates outside the normal JWT verification workflow. This misconfiguration creates an explicit bypass mechanism that allows any remote attacker to register new user accounts without providing valid authentication credentials, effectively undermining the entire authentication framework. The vulnerability aligns with CWE-287 which addresses improper handling of authentication tokens and weak authentication mechanisms, while also demonstrating characteristics of CWE-305 which covers authentication bypass through flawed token validation processes.
The technical implementation of this flaw enables attackers to exploit a direct pathway into the system's user management infrastructure through an intentionally allowlisted endpoint. When an attacker sends a POST request to /auth/profile/create without proper JWT tokens, the application accepts the request and proceeds with account creation, completely bypassing the expected authentication flow. This creates a dangerous condition where unauthorized users can programmatically establish legitimate-looking accounts that may then be used to access protected resources or functionality within the application. The operational impact extends beyond simple account creation as these newly registered accounts could potentially be leveraged for privilege escalation, data exfiltration, or further attack vector exploitation.
The security implications of this vulnerability are particularly severe as it provides attackers with a persistent entry point into the system that can be exploited repeatedly without requiring additional authentication credentials. Once an attacker has established an account through this vulnerability, they can leverage the legitimate user context to access protected functionality, potentially including administrative features or sensitive data repositories. This flaw directly violates the principle of least privilege and demonstrates a failure in the application's authorization model where the system should have enforced proper authentication checks before allowing user creation operations regardless of the endpoint's intended purpose. The vulnerability also creates an attack surface that aligns with ATT&CK technique T1078 which covers valid accounts usage, as attackers can establish persistent access through legitimate account creation mechanisms.
Organizations should implement immediate mitigations including removing the allowlist exemption for the /auth/profile/create endpoint and enforcing proper JWT validation for all authentication-related endpoints. The recommended approach involves implementing comprehensive authentication checks that validate user credentials before allowing any account creation operations, while also establishing proper rate limiting and monitoring on registration endpoints to detect suspicious activity patterns. Additional security controls should include input validation to prevent account enumeration attacks and ensuring that newly created accounts are subject to proper access controls and audit logging mechanisms. The fix should align with industry standards such as NIST SP 800-53 control AC-3 which addresses access enforcement and authentication, while also addressing the broader security architecture principles outlined in ISO/IEC 27001 for proper authentication and access management controls.