CVE-2024-56362

Published: Dec 23, 2024Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. This vulnerability is fixed in 0.54.1.

Affected (1)

Products: Navidrome: Navidrome

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Navidrome Navidrome	Before 0.54.1

Related CWEs

Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

References (3)

https://github.com/navidrome/navidrome/commit/7f030b0859653593fd2ac0df69f4a313f9caf9ff

Source: security-advisories@github.com

Patch

https://github.com/navidrome/navidrome/commit/9cbdb20a318a49daf95888b1fd207d4d729b55f1

Source: security-advisories@github.com

Patch

https://github.com/navidrome/navidrome/security/advisories/GHSA-xwx7-p63r-2rj8

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.