CVE-2026-72605 — Swing Music Swing Music - Missing Authentication

CVE-2026-72605

Swing Music Swing Music - Missing Authentication PUBLISHED

Description (CNA)

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can register an account and use it to access protected functionality on the server.

Affected (CNA)

Vendor / product	Versions
Swing Music / Swing Music	affected 0 through 3.0.0

CWE

CWE-306

References

https://github.com/swingmx/swingmusic

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.