CVE-2024-28194 - CVE House
Back to Database
Status published Critical CVE-2024-28194

Authentication Bypass Because of Hardcoded JWT Secret in your_spotify

Vulnerability Description

your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions < 1.8.0 use a hardcoded JSON Web Token (JWT) secret to sign authentication tokens. Attackers can use this well-known value to forge valid authentication tokens for arbitrary users. This vulnerability allows attackers to bypass authentication and authenticate as arbitrary YourSpotify users, including admin users. This issue has been addressed in version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-28194

Credits & Attribution

No credits recorded in the NVD database.

References

More from Yooooomi

View All →
CVE-2024-28196
Clickjacking in your_spotify
Medium 6.5
CVE-2024-28195
Cross-Site Request Forgery (CSRF) vulnerability in API and login in your_spotify
High 8.1
CVE-2024-28193
Disclosure of Spotify API Access Tokens to Guest Users Using Public Tokens in your_spotify
Medium 6.5
CVE-2024-28192
NoSQL Injection Leading to Authentication Bypass in your_spotify
Medium 5.3

Affected Vendor

Affected Software

your_spotify
Vulnerable Versions:
< 1.8.0

Timeline

Official Publish: March 13th, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-798

MITRE ATT&CK TTPs

T1552 Unsecured Credentials
Credential Access
T1078 Valid Accounts
Persistence
T1021 Remote Services
Lateral Movement
T1190 Exploit Public-Facing Application
Initial Access
T1098 Account Manipulation
Privilege Escalation