x/vulndb: potential Go vuln in github.com/navidrome/navidrome: CVE-2025-27112

[GoVulnBot]

Advisory CVE-2025-27112 references a vulnerability in the following Go modules:

Module
github.com/navidrome/navidrome

Description:
Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system, along with a salted hash of an empty password. Under these conditions, Navidrome treats the request as authenticated, granting access to various Subsonic endpoints without requiring valid credentials. An attacker can use any non-existent username to bypass the authentication system and gain access to ...

References:

• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2025-27112
• FIX: navidrome/navidrome@287079a
• WEB: GHSA-c3p4-vm8f-386p

Cross references:

• github.com/navidrome/navidrome appears in 6 other report(s):
  • data/reports/GO-2022-0302.yaml (x/vulndb: potential Go vuln in github.com/navidrome/navidrome: CVE-2022-23857 #302)
  • data/reports/GO-2023-2414.yaml (x/vulndb: potential Go vuln in github.com/navidrome/navidrome: GHSA-wq59-4q6r-635r #2414)
  • data/reports/GO-2024-2803.yaml (x/vulndb: potential Go vuln in github.com/navidrome/navidrome: CVE-2024-32963 #2803)
  • data/reports/GO-2024-3029.yaml (x/vulndb: potential Go vuln in github.com/navidrome/navidrome: GHSA-hrmx-8jjv-g758 #3029)
  • data/reports/GO-2024-3153.yaml (x/vulndb: potential Go vuln in github.com/navidrome/navidrome: GHSA-58vj-cv5w-v4v6 #3153)
  • data/reports/GO-2024-3357.yaml (x/vulndb: potential Go vuln in github.com/navidrome/navidrome: CVE-2024-56362 #3357)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/navidrome/navidrome
      vulnerable_at: 0.54.5
summary: CVE-2025-27112 in github.com/navidrome/navidrome
cves:
    - CVE-2025-27112
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-27112
    - fix: https://github.com/navidrome/navidrome/commit/287079a9e409fb6b9708ca384d7daa7b5185c1a0
    - web: https://github.com/navidrome/navidrome/security/advisories/GHSA-c3p4-vm8f-386p
source:
    id: CVE-2025-27112
    created: 2025-02-24T20:01:18.205598658Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/654257 mentions this issue: data/reports: add 23 reports