EUVD-2026-114078
GHSA-642p-47qh-4hhp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent-network access to host
-
DeliveryReach /api/v1/auth/login endpoint
-
ExploitAuthenticate with default admin/admin
-
ExecutionInstall malicious QuickJS plugin
-
ImpactExecute code and alter configuration
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the administrator password was left unset/omitted so the embedded backend falls back to the hardcoded admin/admin pair (per the .env.example note and the fix that replaced this with a randomly generated password), and that the attacker can reach the service on the local network - the mobile/embedded mode binds 0.0.0.0 per mobile.go, making it LAN-reachable. Concretely, the attacker POSTs to /api/v1/auth/login with admin/admin, then uses the admin session to change library/config settings and install a QuickJS JavaScript plugin. Limiting factors: AV:A restricts this to adjacent-network attackers (not internet-routable unless the operator exposed it), and an operator who set a strong admin password in configuration is not affected. |
| Impact | This is a genuine, high-priority weakness in the environments where it applies, but its reach is bounded. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) describes adjacent-network, low-complexity, unauthenticated access with high confidentiality, integrity and availability impact to the vulnerable system (VC:H/VI:H/VA:H), and subsequent-system impact is rated none (SC:N/SI:N/SA:N), yielding 8.7. The vuln.today Decision label is 'this_week', consistent with a serious-but-not-emergency posture. No EPSS score and no CISA KEV status were provided, so there is no signal of mass or active exploitation; a public PoC/write-up reference exists (hackmd) but is not confirmed as working exploit code. The most important caveat is that AV:A limits this to attackers already on the same LAN/segment - it is not internet-wide unless the operator has exposed the service - and the flaw only bites when the admin password was left unset so the backend falls back to admin/admin. So this is a real priority for anyone running Songloft in its mobile/embedded or LAN-exposed mode with default credentials, but it is not a drop-everything internet-facing crisis: the adjacency requirement and the default-credential precondition both narrow real-world exposure. |
| Exploit ScenarioDerived | An attacker on the same local network points a browser or script at the Songloft backend's /api/v1/auth/login endpoint and logs in as administrator using the hardcoded admin/admin pair that the embedded backend falls back to when no password is set. With admin access they modify library and configuration settings and install a JavaScript plugin that runs in the bundled QuickJS engine, giving them code execution within the application. A public PoC reference exists (a hackmd write-up); it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Songloft 2.9.0 through 2.13.5 ships an embedded Go backend that falls back to the fixed credential pair admin/admin whenever the administrator username and password are omitted from configuration, letting anyone who can reach the service on the local network log in as administrator through /api/v1/auth/login. From that session an attacker can rewrite library and configuration settings and install JavaScript plugins that execute inside the bundled QuickJS runtime, giving code execution in the server context; the mobile/embedded startup path binds 0.0.0.0, which is what makes the service LAN-reachable in the first place. The issue is unauthenticated from the network perspective (CVSS:4.0 AV:A/AC:L/PR:N/UI:N, 8.7; assessed as CVSS:3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is bounded by two things: the attacker must be on an adjacent network, and operators who set a strong admin password are not affected. A public technical writeup describing the admin-takeover attack exists and is referenced by the CVE record, though it is not verified as working exploit code; vendor-released patch 2.13.6 is available and the priority label is this_week. No public exploit code is confirmed and the CVE is not listed as actively exploited (CISA KEV).
RemediationAI
Upgrade to Songloft 2.13.6 or later, which is the vendor-released patch for this issue and the version boundary stated in the CVE record; the fix is contained in commit 034fc1c442af5d6bc188642f1fb766af648e014d and is tracked in issue https://github.com/songloft-org/songloft/issues/534, with the vendor advisory at https://www.vulncheck.com/advisories/songloft-2.9.0-before-2.13.6-hardcoded-admin-credentials-in-embedded-backend. After upgrading, 2.13.6+ hashes the admin password with bcrypt and, in mobile/embedded mode, generates a random per-install password into an admin_password file (0600) in the data directory instead of falling back to admin/admin - note that mobile clients must read that file from the same data directory to log in, so plan for the credential handoff when rolling the update out. If an immediate upgrade is not possible on 2.9.0 through 2.13.5, set an explicit, strong administrator username and password in Songloft's configuration/.env (both fields are documented in .env.example) so the hardcoded fallback is never reached; the trade-off is that older mobile builds expect the default pair and may need manual credential entry, and any client that already cached admin/admin has to be reconfigured. In parallel, reduce reachability: because the embedded mode binds 0.0.0.0 for DLNA and the HTTP API, place the service behind a firewall rule or segmented VLAN that only admits trusted hosts to the API port, and avoid exposing it to the internet - this does not fix the hardcoded credential but removes the adjacent-network attacker position the CVE requires. Check existing 2.9.0-2.13.5 deployments for signs of unauthorized administrator logins to /api/v1/auth/login and for JavaScript plugins installed in QuickJS that were not placed there by an operator, since plugin installation is the post-authentication impact described in the record.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-798 (Use of Hard-coded Credentials). Songloft is a self-hosted music/library server written in Go; its configuration layer (internal/config/types.go) accepts an admin username and password, and .env.example documents both fields as optional. When they are left empty, the auth service (internal/services/auth_service.go) is constructed with the literal admin/admin pair, and Login compares the submitted username and password against those stored values before issuing a session token. The mobile/embedded entry point (mobile/mobile.go) calls config.NewAppConfig with empty username and password, which is precisely the fatal combination, because the same code path listens on 0.0.0.0 so the DLNA discovery and HTTP API are reachable from the whole LAN segment. The API surface behind the login is unusually powerful: authenticated administrators can modify library and configuration state and install JavaScript plugins, and those plugins are executed by an embedded QuickJS engine, so administrative access upgrades to arbitrary JavaScript code execution inside the backend process. The upstream fix (commit 034fc1c442af5d6bc188642f1fb766af648e014d) addresses several layers at once: it hashes the admin password at startup with bcrypt (golang.org/x/crypto/bcrypt) and keeps only the hash in memory, replaces the plain string comparison with bcrypt.CompareHashAndPassword plus subtle.ConstantTimeCompare on the username so that the early-return comparison no longer leaks timing information, and - most importantly for the embedded mode - adds ensureAdminPassword, which generates an 18-byte random password via crypto/rand, stores it base64url-encoded in an admin_password file under the data directory with 0600 permissions and reuses it on subsequent starts. The commit also rewrites the .env.example comment to warn that omitting both values makes admin/admin fall back and that a strong password is mandatory when the service is exposed or LAN-reachable.
Know when Songloft gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Adjacent LAN reach (AV:A) and trivial login with default creds give AC:L/PR:N/UI:N; admin takeover plus plugin code execution yields C:H/I:H/A:H, scope unchanged as impact stays within the app.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via the /api/v1/auth/login endpoint to modify library and configuration settings and install JavaScript plugins running in QuickJS.
Executive ViewAI
Songloft 2.9.0-2.13.5 contains a high-severity flaw where an embedded Go backend defaults to admin/admin credentials when the administrator account is not configured, allowing anyone on the local network to gain administrative control via the login API. This compromises library data and enables JavaScript plugin execution, potentially leading to full server compromise. Leadership should care because insiders or adjacent-network attackers can silently take over the system, impacting data integrity and IT operations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB