NoSQL Injection Leading to Authentication Bypass in your_spotify

published 2024-03-13 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-25313

cvss: 5.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 49%
public exploits: 0; none known

your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version <1.8.0 is vulnerable to NoSQL injection in the public access token processing logic. Attackers can fully bypass the public token authentication mechanism, regardless if a public token has been generated before or not, without any user interaction or prerequisite knowledge. This vulnerability allows an attacker to fully bypass the public token authentication mechanism, regardless if a public token has been generated before or not, without any user interaction or prerequisite knowledge. This issue has been addressed in version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Patch / fix

fixed in 1

Yooooomi your_spotify 1.8.0

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-03-15)

Exploit prediction

0.60% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/Yooooomi/your_spotify/security/advisories/GHSA-c8wf-wcjc-2pvm referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

Yooooomi your_spotify

Classification

Weakness

CWE-943 Improper Neutralization of Special Elements in Data Query Logic
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component

References

github.com /Yooooomi/your_spotify/security/advisories/GHSA-c8wf-wcjc-2pvm
exploit, vendor-advisory

Sources

CVE List CVE-2024-28192
NVD CVE-2024-28192

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary