CVE-2025-27112

Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system, along with a salted hash of an empty password. Under these conditions, Navidrome treats the request as authenticated, granting access to various Subsonic endpoints without requiring valid credentials. An attacker can use any non-existent username to bypass the authentication system and gain access to various read-only data in Navidrome, such as user playlists. However, any attempt to modify data fails with a "permission denied" error due to insufficient permissions, limiting the impact to unauthorized viewing of information. Version 0.54.5 contains a patch for this issue.

• CWE-287

• https://github.com/navidrome/navidrome/commit/287079a9e409fb6b9708ca384d7daa7b5185c1a0Patch
• https://github.com/navidrome/navidrome/security/advisories/GHSA-c3p4-vm8f-386pExploit, Vendor Advisory

Published

Feb 24, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27107Integrated Scripting is a tool for creating scripts for hand…8.6
• CVE-2025-27108dom-expressions is a Fine-Grained Runtime for Performant DOM…6.1
• CVE-2025-27109solid-js is a declarative, efficient, and flexible JavaScrip…7.3
• CVE-2025-2711A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has…6.1
• CVE-2025-27110Libmodsecurity is one component of the ModSecurity v3 projec…7.5
• CVE-2025-27111Rack is a modular Ruby web server interface. The Rack::Sendf…7.5
• CVE-2025-27113libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL p…7.5
• CVE-2025-2712A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has…6.1
• CVE-2025-27127A vulnerability has been identified in TIA Project-Server (A…5.3
• CVE-2025-27128in OpenHarmony v5.0.3 and prior versions allow a local attac…7.8
• CVE-2025-27129An authentication bypass vulnerability exists in the HTTP au…9.8
• CVE-2025-2713Google gVisor's runsc component exhibited a local privilege …7.8