Is CVE-2021-21399 actively exploited?

No active exploitation of CVE-2021-21399 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2021-21399 be exploited remotely?

Yes. CVE-2021-21399 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2021-21399?

CVE-2021-21399 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2021-21399

HIGH

CVE-2021-21399

CWE-284Published: April 13, 2021· Updated: Jun 17, 2026

7.5

CVSS v3.1

Official Description

Ampache is a web based audio/video streaming application and file manager. Versions prior to 4.4.1 allow unauthenticated access to Ampache using the subsonic API. To successfully make the attack you must use a username that is not part of the site to bypass the auth checks. For more details and workaround guidance see the referenced GitHub security advisory.

NVD Source

Technical Analysis

CVE-2021-21399 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.