Navidrome vulnerabilities
We track 3 vulnerabilities in Navidrome products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on May 30, 2025.
Latest Navidrome vulnerabilities
- 9.8 Critical severity
navidrome: Improper Neutralization of Special Elements used in an SQL Command
Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validation on the `role` parameter within the API endpoint `/api/artist`. Attackers can exploit this flaw to i
- 8.8 High severity
navidrome: Improper Neutralization of Special Elements used in an SQL Command
Navidrome is an open source web-based music collection server and streamer. Navidrome automatically adds parameters in the URL to SQL queries. This can be exploited to access information by adding parameters like `password=...` in the URL (ORM Leak). Furthermo
- 8.6 High severity
navidrome: Improper Authentication
Navidrome is an open source web-based music collection server and streamer. A security vulnerability has been identified in navidrome's subsonic endpoint, allowing for authentication bypass. This exploit enables unauthorized access to any known account by util