Executive brief
Swing Music is a self-hosted music player application. A missing authentication check allows anyone on the network to create arbitrary user accounts without credentials, bypassing normal access controls. An attacker could register an account and gain full access to the music server and its features.
Technical details
The vulnerability is an authentication bypass in the POST /auth/profile/create endpoint in Swing Music 3.0.0. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can reach this endpoint over the network without any prior credentials and create arbitrary user accounts, which can then be used to access protected functionality on the server. A patch or mitigation enforcing authentication on the account creation endpoint is required.
Affected products
- Swing Music Swing Music 3.0.0
Timeline
- 2026-08-11: disclosed