CVE-2024-28194
📋 TL;DR
YourSpotify versions before 1.8.0 use a hardcoded JWT secret, allowing attackers to forge valid authentication tokens for any user. This enables authentication bypass and potential admin account takeover. All self-hosted YourSpotify instances running vulnerable versions are affected.
💻 Affected Systems
- your_spotify
📦 What is this software?
Your Spotify by Yooooomi
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to the YourSpotify instance, potentially accessing sensitive Spotify listening data, modifying configurations, or compromising the hosting server.
Likely Case
Unauthorized access to user accounts, viewing private listening history, and potential data exfiltration from the Spotify tracking dashboard.
If Mitigated
If the instance is behind strong network controls and not internet-facing, risk is limited to internal attackers with network access.
🎯 Exploit Status
Exploitation requires knowledge of the hardcoded secret (publicly disclosed in advisory) and basic JWT manipulation skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.0
Vendor Advisory: https://github.com/Yooooomi/your_spotify/security/advisories/GHSA-gvcr-g265-j827
Restart Required: Yes
Instructions:
1. Backup your current YourSpotify installation and database
2. Stop the YourSpotify service
3. Update to version 1.8.0 using your deployment method (Docker, manual, etc.)
4. Restart the service
5. Verify the update was successful
🔧 Temporary Workarounds
No workarounds available
allThe vendor advisory states there are no known workarounds for this vulnerability.
🧯 If You Can't Patch
- Isolate the YourSpotify instance from untrusted networks
- Implement strict network access controls and monitor authentication logs
🔍 How to Verify
Check if Vulnerable:
Check your YourSpotify version. If it's below 1.8.0, you are vulnerable.Check Version:
Check the YourSpotify web interface or deployment configuration for version information.Verify Fix Applied:
Confirm version is 1.8.0 or higher and test authentication with new tokens.📡 Detection & Monitoring
Log Indicators:
- Unusual authentication patterns
- Multiple failed login attempts followed by successful login from same IP
- Admin account access from unexpected locations
Network Indicators:
- Authentication requests with manipulated JWT tokens
- Unusual API access patterns
SIEM Query:
Search for authentication events with JWT tokens containing the hardcoded secret or unusual user-agent patterns.