EUVD-2026-56044
GHSA-j8m4-xpvr-6gcw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-accessible endpoint with no authentication barrier; integrity-only impact from unrestricted account creation, no confidentiality or availability impact from the endpoint itself.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can register an account and use it to access protected functionality on the server.
AnalysisAI
Unauthenticated account creation in Swing Music 3.0.0 exposes a critical access control gap: the POST /auth/profile/create endpoint is explicitly allowlisted from JWT verification, enabling any network-reachable attacker to register arbitrary user accounts with no credentials. Once registered, the attacker-controlled account can be used to authenticate and access server-protected functionality such as media libraries or administrative features. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, though the low-complexity network vector makes opportunistic exploitation straightforward against exposed instances.
Technical ContextAI
Swing Music is a self-hosted music streaming server (CPE: cpe:2.3:a:swing_music:swing_music:*:*:*:*:*:*:*:*). Its authentication model relies on JWT tokens enforced server-side, with a per-endpoint allowlist that bypasses verification for specific routes. The POST /auth/profile/create endpoint was placed on this allowlist - presumably to support initial setup - but without a conditional guard (e.g., first-run-only, invite token, or admin approval), it remains permanently open. CWE-306 (Missing Authentication for Critical Function) describes this class precisely: a function that modifies system state (account creation) is reachable without satisfying authentication preconditions. Because account creation grants subsequent authenticated access, the missing check has a chained impact beyond the single endpoint.
RemediationAI
No vendor-released patch version is independently confirmed at time of analysis - the sole reference points to the GitHub repository (https://github.com/swingmx/swingmusic) without identifying a tagged fix release. Operators should monitor the repository for a release that addresses this endpoint's authentication bypass and upgrade as soon as one is available. As an immediate compensating control, restrict network access to the Swing Music instance using firewall rules or a reverse proxy so only trusted IP ranges can reach the server; this prevents unauthenticated internet-facing exploitation without disabling the service. If a reverse proxy (e.g., nginx) is in use, add a deny rule for POST requests to /auth/profile/create from untrusted origins - note this may break legitimate account creation flows if used by multiple households. Alternatively, if account creation is not needed post-setup, consider blocking the endpoint entirely at the reverse proxy layer. Do not expose Swing Music directly to the internet until a patch is confirmed.
More in Swing Music
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today