CVE-2024-28194 Authentication Bypass Because of Hardcoded JWT Secret in your_spotify
Attackers can forge authentication tokens using a hardcoded secret to bypass authentication and access arbitrary user accounts, including admin privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-28194?
CVE-2024-28194 is a critical vulnerability in Yooooomi your_spotify, published on 13 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions < 1.8.0 use a hardcoded JSON Web Token (JWT) secret to sign authentication tokens. Attackers can use this well-known value to forge valid authentication tokens for arbitrary users. This vulnerability allows attackers to bypass authentication and authenticate as arbitrary YourSpotify users, including admin users. This issue has been addressed in version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-798
Which versions are affected by CVE-2024-28194?
It affects 1 product.
Products include Yooooomi Your Spotify.
How do I fix CVE-2024-28194?
No fix has been published for CVE-2024-28194 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-28194 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-28194 exists.
Other vulnerabilities in Yooooomi your_spotify
- CVE-2024-28195 Cross-Site Request Forgery (CSRF) vulnerability in API and login in your_spotify
- CVE-2024-28193 Disclosure of Spotify API Access Tokens to Guest Users Using Public Tokens in your_spotify
- CVE-2024-28196 Clickjacking in your_spotify
- CVE-2024-28192 NoSQL Injection Leading to Authentication Bypass in your_spotify
Sources
Also known as GHSA-gvcr-g265-j827.