Skip to content
OpenAdvisories

Vendor

navidrome

9 known vulnerabilities.

Products

navidrome 9
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-25578

    Navidrome is vulnerable to XSS via comment from song metadata

    Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, a cross-site scripting vulnerability in the frontend allows a malicious attacker to inject code through the comment metadata of a song to exfiltrate user cred…

    navidrome navidrome github.com/navidrome/navidrome navidrome Alpine Go
  • Medium 6.9
    CVE-2025-27112 Scanner template

    Navidrome has authentication bypass in Subsonic API with non-existent username

    Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary usern…

    navidrome navidrome github.com/navidrome/navidrome Go
  • Medium 4.2
    CVE-2024-32963

    Parameter Tampering vulnerability in Navidrome

    Navidrome is an open source web-based music collection server and streamer. In affected versions of Navidrome are subject to a parameter tampering vulnerability where an attacker has the ability to manipulate parameter values in the HTTP requests. The attacke…

    navidrome navidrome github.com/navidrome/navidrome Go