Navidrome Stores JWT Secret in Plaintext in navidrome.db
Package
Affected versions
<= 0.53.3
Patched versions
0.54.1
Description
Published by the National Vulnerability Database
Dec 23, 2024
Published to the GitHub Advisory Database
Dec 23, 2024
Reviewed
Dec 23, 2024
Last updated
Dec 23, 2024
Navidrome stores the JWT secret in plaintext in the
navidrome.db
database file under theproperty
table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret.The JWT secret is critical for the authentication and authorization system. If exposed, an attacker could:
This vulnerability has been tested on the latest version of Navidrome and poses a significant risk in environments where the database file is not adequately secured.
References