Back to Database
Status published
High
CVE-2024-56362
Navidrome Stores JWT Secret in Plaintext in navidrome.db
Vulnerability Description
Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. This vulnerability is fixed in 0.54.1.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-56362
Credits & Attribution
No credits recorded in the NVD database.
References
More from navidrome
View All →CVE-2025-48949
Navidrome allows SQL Injection via role parameter
High
8.9
CVE-2025-48948
Navidrome Transcoding Permission Bypass Vulnerability Report
High
7.4
CVE-2025-27112
Navidrome has authentication bypass in Subsonic API with non-existent username
Medium
6.9
CVE-2024-47062
Multiple SQL Injections and ORM Leak in navidrome
Critical
9.4
CVE-2024-32963
Parameter Tampering vulnerability in Navidrome
Medium
4.2
Affected Vendor
navidrome
View all reports →Affected Software
navidrome
Vulnerable Versions:
< 0.54.1
Timeline
Official Publish:
December 23rd, 2024
Last Modified:
December 24th, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N