CVE-2021-21399

Name of the Vulnerable Software and Affected Versions Ampache versions prior to 4.4.1

Description The issue allows unauthenticated access to Ampache using the subsonic API. To exploit this, an attacker must use a username that is not part of the site to bypass the auth checks.

Recommendations For versions prior to 4.4.1, update to version 4.4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the subsonic API until a patch is applied. Avoid using unknown or unverified username values in the subsonic API to minimize the risk of exploitation.