CVE-2024-56362: Navidrome

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. This vulnerability is fixed in 0.54.1.

Affected products

• Navidrome Navidrome: before 0.54.1 (fixed in 0.54.1)

Published 2024-12-23. Last modified 2026-06-17.