CVE-2024-28193
CVSS 3.1 Score 6.5 of 10 (medium)
Details
Summary
CVE-2024-28193 is a vulnerability affecting the open-source, self-hosted Spotify tracking dashboard, YourSpotify. Versions below 1.8.0 allow users to generate public tokens for guest access, which, when used on the /me API endpoint, discloses Spotify API access and refresh tokens. Attackers with public tokens can obtain Spotify users' profile information, listening habits, playlists, and even pause or resume playback in the Spotify app. This vulnerability has been addressed in version 1.8.0, and users are advised to upgrade as soon as possible. There are currently no known workarounds for this issue.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.