CVE-2026-25578
Cross-Site Scripting in Navidrome Frontend Enables Credential Theft
Publication date: 2026-02-04
Last updated on: 2026-02-18
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| navidrome | navidrome | to 0.60.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-80 | The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Navidrome to version 0.60.0 or later, where the cross-site scripting issue has been patched.
Can you explain this vulnerability to me?
This vulnerability is a cross-site scripting (XSS) issue in Navidrome, an open source web-based music collection server and streamer. Before version 0.60.0, an attacker could inject malicious code through the comment metadata of a song in the frontend interface.
This injected code could then be used to steal user credentials by exfiltrating them from the affected system.
The vulnerability has been fixed in version 0.60.0.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to steal your user credentials through malicious code injected into song comment metadata.
If exploited, it could lead to unauthorized access to your Navidrome account or other systems where the same credentials are used.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know