CVE-2021-21399: 
Linux Ubuntu vulnerability analysis and mitigation

Ampache, a web-based audio/video streaming application and file manager, was found to contain a vulnerability in versions prior to 4.4.1 that allowed unauthenticated access to the application using the subsonic API. The vulnerability was assigned CVE-2021-21399 and was discovered in December 2020, with public disclosure in April 2021 (GitHub Advisory).

The vulnerability existed in the subsonic API authentication mechanism where attackers could bypass authentication checks by using a username that was not registered on the site. This security flaw allowed unauthorized access to Ampache's functionality through the subsonic API endpoint. The issue was present in the token check functionality within the auth.class.php file (GitHub Advisory).

The vulnerability allowed unauthorized users to access Ampache's functionality through the subsonic API, potentially exposing sensitive audio and video content to unauthorized users. An attacker could access features such as playlists and other system functionalities without proper authentication (GitHub Advisory).

The vulnerability could be exploited by making specific API requests to the subsonic endpoint using a non-existent username. An example attack URL would include parameters for the subsonic API with an invalid user account, allowing authentication bypass (GitHub Advisory).

The vulnerability was patched in Ampache version 4.4.1 and in the develop branch (commit 3c12ef26c). For users unable to update immediately, a workaround was provided to modify the token_check function in lib/class/auth.class.php. Alternatively, users could disable the Subsonic Backend completely (GitHub Advisory).