# CVE-2025-27112: Navidrome - Authentication Bypass

> Live exploitation tracking for CVE-2025-27112 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-27112

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 6.9
- **Public exploit available:** Yes
- **Affected products:** Navidrome
- **Weaknesses:** CWE-287 (Improper Authentication)
- **Tags:** web_application

## Description

Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system, along with a salted hash of an empty password. Under these conditions, Navidrome treats the request as authenticated, granting access to various Subsonic endpoints without requiring valid credentials. An attacker can use any non-existent username to bypass the authentication system and gain access to various read-only data in Navidrome, such as user playlists. However, any attempt to modify data fails with a "permission denied" error due to insufficient permissions, limiting the impact to unauthorized viewing of information. Version 0.54.5 contains a patch for this issue.

## CrowdSec analysis

[CVE-2025-27112](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-27112) is a vulnerability in Navidrome that allows attackers to bypass authentication on certain Subsonic API endpoints by using any non-existent username and a specific password hash. This flaw enables unauthorized users to access read-only data, such as user playlists, without valid credentials. While the vulnerability does not permit data modification, it poses a risk of information disclosure to anyone with network access to the affected Navidrome instance.

CrowdSec has been tracking this vulnerability and its exploits since 10th of September 2025.

CrowdSec network observations suggest that most exploitation of CVE-2025-27112 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2025-27112 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit this vulnerability by sending requests to Subsonic API endpoints such as `/rest/getPlaylists` with arbitrary, non-existent usernames and a crafted hash, bypassing authentication to gain unauthorized read-only access to user data.

## Timeline

- 2025-02-24: CVE Published. CVE-2025-27112 is published to NVD.
- 2025-09-10: Rule Released. CrowdSec releases a rule to detect CVE-2025-27112 exploitation attempts against the CrowdSec Network.
- 2025-09-11: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-27112 for the first time.

## References

- https://github.com/navidrome/navidrome/security/advisories/GHSA-c3p4-vm8f-386p
- https://github.com/navidrome/navidrome/commit/287079a9e409fb6b9708ca384d7daa7b5185c1a0
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27112.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-27112) follows observed exploitation activity for CVE-2025-27112. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.