CVE-2025-27112

CVE-2025-27112 describes an authentication bypass vulnerability in Navidrome, an open-source web-based music server, affecting versions 0.52.0 through 0.54.4. This flaw allows an unauthenticated attacker to specify a non-existent username with a salted empty password hash, granting unauthorized access to various read-only Subsonic API endpoints, such as user playlists. Rated Medium with a CVSS score of 6.5, the vulnerability has a network attack vector, low attack complexity, and requires no privileges or user interaction, but prevents data modification. While not in CISA's KEV catalog, it is on the "Hot List" with an elevated EPSS score, and Nuclei templates are available for detection, indicating active community attention and potential for exploitation.