CVE-2024-28193

your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version <1.8.0 allows users to create a public token in the settings, which can be used to provide guest-level access to the information of that specific user in YourSpotify. The /me API endpoint discloses Spotify API access and refresh tokens to guest users. Attackers with access to a public token for guest access to YourSpotify can therefore obtain access to Spotify API tokens of YourSpotify users. As a consequence, attackers may extract profile information, information about listening habits, playlists and other information from the corresponding Spotify profile. In addition, the attacker can pause and resume playback in the Spotify app at will. This issue has been resolved in version 1.8.0. Users are advised to upgrade. There are no known workarounds for this issue.

• CWE-200

• https://github.com/Yooooomi/your_spotify/security/advisories/GHSA-3782-758f-mj85Exploit, Vendor Advisory
• https://github.com/Yooooomi/your_spotify/security/advisories/GHSA-3782-758f-mj85Exploit, Vendor Advisory

Published

Mar 13, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28188Jupyter Scheduler is collection of extensions for programmin…5.3
• CVE-2024-28189Judge0 is an open-source online code execution system. The a…10
• CVE-2024-2819Incorrect Default Permissions, Improper Preservation of Perm…6.5
• CVE-2024-28190Contao is an open source content management system. Starting…5.4
• CVE-2024-28191Contao is an open source content management system. Starting…5.4
• CVE-2024-28192your_spotify is an open source, self hosted Spotify tracking…5.3
• CVE-2024-28194your_spotify is an open source, self hosted Spotify tracking…9.8
• CVE-2024-28195your_spotify is an open source, self hosted Spotify tracking…8.8
• CVE-2024-28196your_spotify is an open source, self hosted Spotify tracking…6.1
• CVE-2024-28197Zitadel is an open source identity management system. Zitade…7.5
• CVE-2024-28198OpenOlat is an open source web-based e-learning platform for…7.5
• CVE-2024-28199phlex is an open source framework for building object-orient…6.1