CVE-2024-56362 Navidrome Stores JWT Secret in Plaintext in navidrome.db
Attackers with database access can retrieve the plaintext JWT secret, enabling session forgery and unauthorized access to the Navidrome music server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-56362?
CVE-2024-56362 is a high-severity vulnerability in navidrome, published on 23 Dec 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. This vulnerability is fixed in 0.54.1.
Weakness: CWE-312
Which versions are affected by CVE-2024-56362?
3 open source packages ship an affected version, including github.com/navidrome/navidrome. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/navidrome/navidrome Go | All versions | 0.54.1 |
github.com/navidrome/navidrome Go | All versions | 0.54.1 |
github.com/navidrome/navidrome Go | All versions | 0.54.1 |
Products include Navidrome Navidrome.
How do I fix CVE-2024-56362?
Upgrade github.com/navidrome/navidrome to 0.54.1 or later.
Is CVE-2024-56362 being exploited?
There is no known exploitation of CVE-2024-56362 in the wild and no public exploit code.
Other vulnerabilities in navidrome
- CVE-2024-47062 Multiple SQL Injections and ORM Leak in navidrome
- CVE-2026-25579 Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints
- CVE-2024-41259 Navidrome uses MD5 hashing algorithm
- CVE-2025-48949 Navidrome allows SQL Injection via role parameter
- CVE-2023-51442 Authentication bypass vulnerability in navidrome's subsonic endpoint
Sources
Also known as GHSA-xwx7-p63r-2rj8, GO-2024-3357.