Navidrome up to 0.54.4 Subsonic API Endpoint improper authentication

Summaryinfo

A vulnerability marked as critical has been reported in Navidrome up to 0.54.4. The impacted element is an unknown function of the component Subsonic API Endpoint. The manipulation leads to improper authentication. This vulnerability is traded as CVE-2025-27112. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Navidrome up to 0.54.4 and classified as critical. This issue affects an unknown code of the component Subsonic API Endpoint. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system, along with a salted hash of an empty password. Under these conditions, Navidrome treats the request as authenticated, granting access to various Subsonic endpoints without requiring valid credentials. An attacker can use any non-existent username to bypass the authentication system and gain access to various read-only data in Navidrome, such as user playlists. However, any attempt to modify data fails with a "permission denied" error due to insufficient permissions, limiting the impact to unauthorized viewing of information. Version 0.54.5 contains a patch for this issue.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2025-27112 since 02/18/2025. The exploitation is known to be easy. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 0.54.5 eliminates this vulnerability. Applying the patch 287079a9e409fb6b9708ca384d7daa7b5185c1a0 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Navidrome

Version

• 0.54.0
• 0.54.1
• 0.54.2
• 0.54.3
• 0.54.4

License

• open-source

Website

• Product: https://github.com/navidrome/navidrome/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion