Navidrome - Authentication Bypass (CVE-2025-27112)
Description
Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system, along with a salted hash of an empty password. Under these conditions, Navidrome treats the request as authenticated, granting access to various Subsonic endpoints without requiring valid credentials. An attacker can use any non-existent username to bypass the authentication system and gain access to various read-only data in Navidrome, such as user playlists. However, any attempt to modify data fails with a "permission denied" error due to insufficient permissions, limiting the impact to unauthorized viewing of information. Version 0.54.5 contains a patch for this issue.
psychologyCrowdSec Analysis
CVE-2025-27112 is a vulnerability in Navidrome that allows attackers to bypass authentication on certain Subsonic API endpoints by using any non-existent username and a specific password hash. This flaw enables unauthorized users to access read-only data, such as user playlists, without valid credentials. While the vulnerability does not permit data modification, it poses a risk of information disclosure to anyone with network access to the affected Navidrome instance.
CrowdSec has been tracking this vulnerability and its exploits since 10th of September 2025.
CrowdSec network observations suggest that most exploitation of CVE-2025-27112 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. CrowdSec data also reveals a clear uptick in attacks involving CVE-2025-27112 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.
Attackers exploit this vulnerability by sending requests to Subsonic API endpoints such as /rest/getPlaylists with arbitrary, non-existent usernames and a crafted hash, bypassing authentication to gain unauthorized read-only access to user data.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-02-24 |
| Rule Released | 2025-09-10 |
| CrowdSec First Seen | 2025-09-11 |