GCVE - cpe:2.3:a:navidrome:navidrome:*:*:*:*:*:go:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:navidrome:navidrome:*:*:*:*:*:go:*:*

part: a version: * update: *

Notes

Imported from purl2cpe mapping

PURL	Source	Last updated
`pkg:github/navidrome/navidrome`	purl2cpe	2026-06-01 10:15:01.915716
`pkg:rpm/opensusenavidrome`	purl2cpe	2026-06-01 10:15:01.915718

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-27112`	vulnerable	2026-06-08 07:14:54.169107	Navidrome has authentication bypass in Subsonic API with non-existent username Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system, along with a salted hash of an empty password. Under these conditions, Navidrome treats the request as authenticated, granting access to various Subsonic endpoints without requiring valid credentials. An attacker can use any non-existent username to bypass the authentication system and gain access to various read-only data in Navidrome, such as user playlists. However, any attempt to modify data fails with a "permission denied" error due to insufficient permissions, limiting the impact to unauthorized viewing of information. Version 0.54.5 contains a patch for this issue. Published: 2025-02-24T18:37:14.221Z Updated: 2025-02-24T19:00:44.866Z Open on db.gcve.eu Reference links https://github.com/navidrome/navidrome/security/advisories/GHSA-c3p4-vm8f-386p https://github.com/navidrome/navidrome/commit/287079a9e409fb6b9708ca384d7daa7b5185c1a0	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.