Vulnerability · Published Mar 13, 2024 · Assigned by GitHub_M

CVE-2024-28194Authentication Bypass Because of Hardcoded JWT Secret in your_spotify

Critical 9.1

In plain English

A critical-severity hard-coded credentials in your_spotify from Yooooomi. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.8%top 42.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions < 1.8.0 use a hardcoded JSON Web Token (JWT) secret to sign authentication tokens. Attackers can use this well-known value to forge valid authentication tokens for arbitrary users. This vulnerability allows attackers to bypass authentication and authenticate as arbitrary YourSpotify users, including admin users. This issue has been addressed in version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
Yooooomi	your_spotify	< 1.8.0

Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/Yooooomi/your_spotify/security/advisories/GHSA-gvcr-g265-j827 x_refsource_CONFIRM