FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Navidrome -- Authentication bypass in Subsonic API

Affected packages
		navidrome	<	0.54.5
0.52.0	<	navidrome

Details

VuXML ID	5ca2cafa-1f24-11f0-ab07-f8f21e52f724
Discovery	2025-02-25
Entry	2025-04-22

Deluan reports:

In certain Subsonic API endpoints, authentication can be bypassed by using a non-existent username combined with an empty (salted) password hash. This allows read-only access to the server’s resources, though attempts at write operations fail with a “permission denied” error.

[source]

References

CVE Name	CVE-2025-27112
URL	https://nvd.nist.gov/vuln/detail/CVE-2025-27112