CVE-2024-28194
CVSS 3.1 Score 9.1 of 10 (high)
Details
Summary
CVE-2024-28194 is a vulnerability affecting versions of the open-source, self-hosted Spotify tracking dashboard, YourSpotify, below 1.8.0. The issue lies in the use of a hardcoded JSON Web Token (JWT) secret for signing authentication tokens. Malicious actors can exploit this weakness to generate valid tokens for unauthorized access, enabling them to authenticate as any YourSpotify user, including administrators. This vulnerability was resolved in version 1.8.0. It is strongly recommended that users upgrade to secure their systems against unauthorized authentication by attackers. At present, there are no reported workarounds for this issue.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.