CVE-2024-41259 Navidrome uses MD5 hashing algorithm
Attackers can manipulate user account information due to insecure hashing in Gravatar integration, affecting Navidrome music server users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-41259?
CVE-2024-41259 is a critical vulnerability in n/a, published on 1 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account information.
Weakness: CWE-200
Which versions are affected by CVE-2024-41259?
3 open source packages ship an affected version, including github.com/navidrome/navidrome. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/navidrome/navidrome Go | All versions | None |
github.com/navidrome/navidrome Go | All versions to 0.52.3 | None |
github.com/navidrome/navidrome Go | All versions to 0.52.3 | None |
Products include Navidrome Navidrome.
How do I fix CVE-2024-41259?
No fix has been published for CVE-2024-41259 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-41259 being exploited?
There is no known exploitation of CVE-2024-41259 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2024-47062 Multiple SQL Injections and ORM Leak in navidrome
- CVE-2026-25579 Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints
- CVE-2025-48949 Navidrome allows SQL Injection via role parameter
- CVE-2023-51442 Authentication bypass vulnerability in navidrome's subsonic endpoint
- CVE-2025-48948 Navidrome Transcoding Permission Bypass Vulnerability Report
Sources
Also known as GHSA-hrmx-8jjv-g758, GO-2024-3029.