CVE-2024-28194

Authentication Bypass Because of Hardcoded JWT Secret in your_spotify

State: Published
Severity: 9.1 Critical
Published: Mar 13, 2024
Updated: Aug 2, 2024
Reserved: Mar 6, 2024

Description

your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions < 1.8.0 use a hardcoded JSON Web Token (JWT) secret to sign authentication tokens. Attackers can use this well-known value to forge valid authentication tokens for arbitrary users. This vulnerability allows attackers to bypass authentication and authenticate as arbitrary YourSpotify users, including admin users. This issue has been addressed in version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	GitHub_M

Weaknesses

CWE-798 Use of Hard-coded Credentials

Affected Products

Product	Versions
your_spotifyYooooomi	< 1.8.0Affected

References

https://github.com/Yooooomi/your_spotify/security/advisories/GHSA-gvcr-g265-j827

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.