Skip to content
OpenAdvisories

Package · Go

github.com/navidrome/navidrome

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.9
    CVE-2025-48949

    Navidrome allows SQL Injection via role parameter

    Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validation on the `role` parameter within the API endpoint `/api/artist`. Attackers can exploit this flaw to …

    navidrome navidrome github.com/navidrome/navidrome navidrome Alpine Go
  • High 7.4
    CVE-2025-48948

    Navidrome Transcoding Permission Bypass Vulnerability Report

    Navidrome is an open source web-based music collection server and streamer. A permission verification flaw in versions prior to 0.56.0 allows any authenticated regular user to bypass authorization checks and perform administrator-only transcoding configuratio…

    navidrome navidrome github.com/navidrome/navidrome navidrome Alpine Go
  • High 7.1
    CVE-2024-56362

    Navidrome Stores JWT Secret in Plaintext in navidrome.db

    Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the dat…

    navidrome navidrome github.com/navidrome/navidrome Go
  • High 8.6
    CVE-2023-51442

    Authentication bypass vulnerability in navidrome's subsonic endpoint

    Navidrome is an open source web-based music collection server and streamer. A security vulnerability has been identified in navidrome's subsonic endpoint, allowing for authentication bypass. This exploit enables unauthorized access to any known account by uti…

    navidrome navidrome github.com/navidrome/navidrome Go