CVE-2024-28195

your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions < 1.9.0 do not protect the API and login flow against Cross-Site Request Forgery (CSRF). Attackers can use this to execute CSRF attacks on victims, allowing them to retrieve, modify or delete data on the affected YourSpotify instance. Using repeated CSRF attacks, it is also possible to create a new user on the victim instance and promote the new user to instance administrator if a legitimate administrator visits a website prepared by an attacker. Note: Real-world exploitability of this vulnerability depends on the browser version and browser settings in use by the victim. This issue has been addressed in version 1.9.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-352
• CWE-352

• https://github.com/Yooooomi/your_spotify/commit/c3ae87673910c9903bb53088c8b71ed2c9aa54e4Patch
• https://github.com/Yooooomi/your_spotify/security/advisories/GHSA-hfgf-99p3-6fjjExploit, Vendor Advisory
• https://github.com/Yooooomi/your_spotify/commit/c3ae87673910c9903bb53088c8b71ed2c9aa54e4Patch
• https://github.com/Yooooomi/your_spotify/security/advisories/GHSA-hfgf-99p3-6fjjExploit, Vendor Advisory

Published

Mar 13, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-2819Incorrect Default Permissions, Improper Preservation of Perm…6.5
• CVE-2024-28190Contao is an open source content management system. Starting…5.4
• CVE-2024-28191Contao is an open source content management system. Starting…5.4
• CVE-2024-28192your_spotify is an open source, self hosted Spotify tracking…5.3
• CVE-2024-28193your_spotify is an open source, self hosted Spotify tracking…6.5
• CVE-2024-28194your_spotify is an open source, self hosted Spotify tracking…9.8
• CVE-2024-28196your_spotify is an open source, self hosted Spotify tracking…6.1
• CVE-2024-28197Zitadel is an open source identity management system. Zitade…7.5
• CVE-2024-28198OpenOlat is an open source web-based e-learning platform for…7.5
• CVE-2024-28199phlex is an open source framework for building object-orient…6.1
• CVE-2024-2820A vulnerability classified as problematic was found in DedeC…4.3
• CVE-2024-28200The N-central server is vulnerable to an authentication bypa…9.8