CVE-2026-72605: Swing Music Auth Bypass Vulnerability

CVE-2026-72605 Overview

CVE-2026-72605 is a missing authentication vulnerability in Swing Music 3.0.0. The flaw allows unauthenticated remote attackers to create arbitrary user accounts through the POST /auth/profile/create endpoint. This endpoint is allowlisted from JSON Web Token (JWT) verification, permitting account creation without any credentials. An attacker can register an account and then use it to access protected functionality on the server. The vulnerability is categorized under Missing Authentication for Critical Function [CWE-306] and is exploitable over the network without user interaction.

Critical Impact
Unauthenticated remote attackers can create arbitrary user accounts and gain access to protected server functionality in Swing Music 3.0.0.

Affected Products

Swing Music 3.0.0

Discovery Timeline

2026-08-11 - CVE-2026-72605 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72605

Vulnerability Analysis

Swing Music is an open-source music streaming server. Version 3.0.0 exposes an account creation endpoint at POST /auth/profile/create that bypasses the server's authentication layer. The endpoint appears in the JWT verification allowlist, so the middleware skips token validation for requests targeting it.

An attacker sends an HTTP POST request to /auth/profile/create with an arbitrary username and password payload. The server accepts the request without verifying the caller's identity and provisions a new user account. The attacker then authenticates using the newly created credentials and reaches functionality that the application intends to gate behind authentication.

Root Cause

The root cause is Missing Authentication for Critical Function [CWE-306]. Account provisioning is a privileged operation, but the developer's allowlist explicitly exempts the endpoint from JWT enforcement. This design decision removes the only authentication control protecting new user creation on the server.

Attack Vector

Exploitation requires only network access to a running Swing Music 3.0.0 instance. No credentials, tokens, or user interaction are needed. An attacker crafts a single POST request to /auth/profile/create containing account attributes, receives a success response, and authenticates against the same instance using the created account. From there, the attacker interacts with protected APIs available to normal authenticated users. Refer to the Swing Music GitHub repository for source-level details on the affected endpoint and authentication middleware.

Detection Methods for CVE-2026-72605

Indicators of Compromise

HTTP POST requests to /auth/profile/create from external or untrusted source addresses.
Unexpected new user accounts appearing in the Swing Music user database without administrator action.
Successful authentication events immediately following account creation from the same source IP address.

Detection Strategies

Inspect web server and reverse proxy logs for POST /auth/profile/create requests that lack an authenticated session context.
Correlate account creation events with subsequent login events sharing the same source IP within a short time window.
Baseline the expected volume of account creation events and alert on deviations, particularly from internet-exposed instances.

Monitoring Recommendations

Forward Swing Music application logs and reverse proxy access logs to a centralized logging platform for continuous review.
Track HTTP 200 responses returned from /auth/profile/create and generate alerts when the request originates from outside trusted networks.
Monitor the user table for growth in account count and flag creations occurring outside administrative maintenance windows.

How to Mitigate CVE-2026-72605

Immediate Actions Required

Restrict network access to Swing Music instances by placing them behind a VPN, authenticated reverse proxy, or firewall allowlist until a patched release is deployed.
Audit the user database for accounts created without administrator approval and disable or delete any unauthorized entries.
Rotate credentials and invalidate active sessions for any accounts that may have been provisioned by an attacker.

Patch Information

At the time of publication, no fixed version has been listed in the CVE record. Monitor the Swing Music GitHub repository for security updates and upgrade to a release that removes /auth/profile/create from the JWT allowlist or gates it behind administrator authentication.

Workarounds

Block or restrict the /auth/profile/create endpoint at the reverse proxy layer, allowing requests only from trusted management networks.
Disable public registration functionality if the deployment does not require self-service account creation.
Place Swing Music behind an authenticating gateway that enforces identity checks before any request reaches the application.

bash

# Example nginx configuration to block unauthenticated access to the vulnerable endpoint
location = /auth/profile/create {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://swingmusic_backend;
}