CVE-2024-28194: Authentication Bypass Because of Hardcoded JWT Secret in your_spotify
yourspotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions < 1.8.0 use a hardcoded JSON Web Token (JWT) secret to sign authentication tokens. Attackers can use this well-known value to forge valid authentication tokens for arbitrary users. This vulnerability allows attackers to bypass authentication and authenticate as arbitrary YourSpotify users, including admin users. This issue has been addressed in version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28194?
CVE-2024-28194 is classified as a critical vulnerability due to the potential for unauthorized access to user accounts.
How do I fix CVE-2024-28194?
To fix CVE-2024-28194, upgrade your your_spotify installation to version 1.8.0 or higher to eliminate the hardcoded JWT secret.
Who is affected by CVE-2024-28194?
CVE-2024-28194 affects all versions of your_spotify prior to 1.8.0.
What are the risks of CVE-2024-28194?
The risks of CVE-2024-28194 include the ability for attackers to forge valid authentication tokens and gain unauthorized access to user accounts.
What type of vulnerability is CVE-2024-28194?
CVE-2024-28194 is an authentication vulnerability that involves a hardcoded JSON Web Token (JWT) secret.