Swing Music
Monthly
Unauthenticated account creation in Swing Music 3.0.0 exposes a critical access control gap: the POST /auth/profile/create endpoint is explicitly allowlisted from JWT verification, enabling any network-reachable attacker to register arbitrary user accounts with no credentials. Once registered, the attacker-controlled account can be used to authenticate and access server-protected functionality such as media libraries or administrative features. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, though the low-complexity network vector makes opportunistic exploitation straightforward against exposed instances.
Swing Music is a self-hosted music player for local audio files. versions up to 2.1.4 contains a security vulnerability.
Unauthenticated account creation in Swing Music 3.0.0 exposes a critical access control gap: the POST /auth/profile/create endpoint is explicitly allowlisted from JWT verification, enabling any network-reachable attacker to register arbitrary user accounts with no credentials. Once registered, the attacker-controlled account can be used to authenticate and access server-protected functionality such as media libraries or administrative features. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, though the low-complexity network vector makes opportunistic exploitation straightforward against exposed instances.
Swing Music is a self-hosted music player for local audio files. versions up to 2.1.4 contains a security vulnerability.