CVE-2026-72605

Name of the Vulnerable Software and Affected Versions Swing Music version 3.0.0

Description A missing authentication issue allows unauthenticated remote attackers to create arbitrary user accounts. This occurs because the 'POST /auth/profile/create' endpoint is allowlisted from JWT (JSON Web Token) verification, which is a standard for securely transmitting information between parties as a JSON object. An attacker can register an account to gain access to protected server functionality.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the 'POST /auth/profile/create' endpoint to minimize the risk of unauthorized account creation.