CVE-2024-56362
Navidrome Stores JWT Secret in Plaintext in navidrome.db
Summary
Navidrome Stores JWT Secret in Plaintext in navidrome.db
Original description
The description as published by the source.
Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. This vulnerability is fixed in 0.54.1.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com