CVE-2024-28196

CVE-2024-28196 is a clickjacking vulnerability affecting YourSpotify versions prior to 1.9.0. This flaw allows attackers to embed a user's YourSpotify instance within an invisible iframe on a malicious website. By tricking logged-in users into interacting with the attacker's page, malicious actions such as allowing new user sign-ups or deleting the current user account can be unknowingly triggered. The vulnerability has a CVSS score of 6.1 (Medium), indicating that it can be exploited remotely with low attack complexity, requiring user interaction, and impacting both confidentiality and integrity. The primary impact is the unauthorized manipulation of user accounts and settings within YourSpotify. Currently, there is no evidence of active exploitation, nor is there publicly available exploit code in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal.