Xumoyunbek Obidjonov

**Name of the Vulnerable Software and Affected Versions** Swing Music version 3.0.0 **Description** A missing authentication issue allows unauthenticated remote attackers to create arbitrary user accounts. This occurs because the 'POST /auth/profile/create' endpoint is allowlisted from JWT (JSON Web Token) verification, which is a standard for securely transmitting information between parties as a JSON object. An attacker can register an account to gain access to protected server functionality. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the 'POST /auth/profile/create' endpoint to minimize the risk of unauthorized account creation.