# Navidrome v0.62.0

- Product: Navidrome (https://whatsnew.fyi/product/navidrome)
- Vendor: Navidrome
- Date: 2026-06-08
- Version: v0.62.0
- Original notes: https://github.com/navidrome/navidrome/releases/tag/v0.62.0
- Permalink: https://whatsnew.fyi/product/navidrome/releases/v0.62.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Support for OpenSubsonic sonicSimilarity extension enabling audio-based similarity through plugins with getSonicSimilarTracks and findSonicPath endpoints
- **added** — New OpenSubsonic playbackReport extension for playback reporting in the UI
- **added** — ReplayGain fields in smart playlists
- **added** — New isMissing and isPresent operators for smart playlists
- **added** — Five new UI themes
- **added** — EnforceNonRootUser option to exit early on startup if Navidrome is running as root
- **added** — Transcoding.MaxConcurrent option to set maximum number of concurrent transcodes server-wide
- **added** — Transcoding.MaxConcurrentPerUser option to set maximum number of concurrent transcodes per user
- **added** — Matcher.PreferStarred option to bias the fuzzy matcher toward starred and high-rated tracks
- **added** — UIPlaybackReportInterval option to configure how often the UI reports playback progress
- **changed** — Redesigned Now Playing experience and playback reporting panel using OpenSubsonic playbackReport extension
- **changed** — Renamed EnableTranscodingCancellation to Transcoding.EnableCancellation and moved under Transcoding section
- **changed** — Renamed SimilarSongsMatchThreshold to Matcher.FuzzyThreshold and moved under Matcher section
- **security** — Enforce per-user ownership on share reads to fix cross-account disclosure of other users' shares and share tokens
- **security** — Enforce ownership atomically on player and share updates to fix cross-tenant player takeover and share-update IDOR
- **security** — Require signed state token on Last.fm link callback to fix unauthenticated scrobble session hijack
- **security** — Validate token expiration and share existence on public share stream endpoints to fix JWT expiration bypass
- **security** — Restrict transcoding configuration reads to admins to fix disclosure of admin-only configuration to non-admin users
- **security** — Require admin access for Subsonic internet radio station management endpoints to fix missing authorization
- **security** — Cap concurrent transcodes to prevent ffmpeg-based denial of service with per-server and per-user limits

This release introduces support for the OpenSubsonic **`sonicSimilarity`** extension, enabling audio-based similarity through the plugin system: when a plugin provides the capability, the new `getSonicSimilarTracks` and `findSonicPath` endpoints unlock smarter, sound-based recommendations and playlists. One plugin that implements it is [AudioMuse-AI](https://github.com/NeptuneHub/AudioMuse-AI-NV-plugin). It also brings a major overhaul to playback reporting and the **Now Playing** experience — the UI now uses the new OpenSubsonic `playbackReport` extension, replacing the old scrobble flow with a redesigned panel and configurable reporting interval. On the security front, it hardens the server with stronger ownership and authorization checks across shares, players, and transcoding endpoints, caps concurrent transcodes to prevent ffmpeg-based denial of service, and adds an option to refuse to run as root. Smart playlists gain ReplayGain fields and new `isMissing`/`isPresent` operators, and there are five new UI themes to choose from.

##### Security

This release fixes several reported vulnerabilities. We thank the security researchers who responsibly disclosed them.

- Fix cross-account disclosure of other users' shares (incl. share tokens) by enforcing per-user ownership on share reads. ([1e7996f5d](https://github.com/navidrome/navidrome/commit/1e7996f5d), [GHSA-3g4p-jhv2-xrxf](https://github.com/navidrome/navidrome/security/advisories/GHSA-3g4p-jhv2-xrxf), reported by [@Wernerina](https://github.com/Wernerina))
- Fix cross-tenant player takeover and share-update IDOR by enforcing ownership atomically on player and share updates. ([#5563](https://github.com/navidrome/navidrome/pull/5563), [GHSA-x65f-m8x9-pjxm](https://github.com/navidrome/navidrome/security/advisories/GHSA-x65f-m8x9-pjxm) reported by [@tonghuaroot](https://github.com/tonghuaroot); [GHSA-58gr-c777-g23p](https://github.com/navidrome/navidrome/security/advisories/GHSA-58gr-c777-g23p) reported by [@lighthousekeeper1212](https://github.com/lighthousekeeper1212); [GHSA-wx2c-q8g7-4q5p](https://github.com/navidrome/navidrome/security/advisories/GHSA-wx2c-q8g7-4q5p) reported by [@CE2Sec](https://github.com/CE2Sec))
- Fix unauthenticated Last.fm scrobble session hijack (IDOR) by requiring a signed state token on the link callback. ([#5521](https://github.com/navidrome/navidrome/pull/5521), [GHSA-8jrh-w926-8rvw](https://github.com/navidrome/navidrome/security/advisories/GHSA-8jrh-w926-8rvw), reported by [@geo-chen](https://github.com/geo-chen))
- Fix JWT expiration bypass on public share stream endpoints by validating token expiration and share existence. ([#5426](https://github.com/navidrome/navidrome/pull/5426), [GHSA-3rfj-qx9q-jghx](https://github.com/navidrome/navidrome/security/advisories/GHSA-3rfj-qx9q-jghx), reported by [@wooseokdotkim](https://github.com/wooseokdotkim))
- Fix disclosure of admin-only transcoding configuration to non-admin users by restricting transcoding config reads to admins. ([#5564](https://github.com/navidrome/navidrome/pull/5564), [GHSA-4p3r-6362-833w](https://github.com/navidrome/navidrome/security/advisories/GHSA-4p3r-6362-833w), reported by [@DavidCarliez](https://github.com/DavidCarliez))
- Fix missing admin authorization on internet radio station management endpoints by requiring admin access for Subsonic management endpoints. ([#5510](https://github.com/navidrome/navidrome/pull/5510), [GHSA-jw24-qqrj-633c](https://github.com/navidrome/navidrome/security/advisories/GHSA-jw24-qqrj-633c), reported by [@osageling](https://github.com/osageling))
- Cap concurrent transcodes to prevent an ffmpeg-based denial of service, with new per-server and per-user limits. ([#5522](https://github.com/navidrome/navidrome/pull/5522) by [@deluan](https://github.com/deluan))
- Add `EnforceNonRootUser` option to exit early if Navidrome is started as root. ([#5373](https://github.com/navidrome/navidrome/pull/5373) by [@kopf](https://github.com/kop

_[Truncated at 4000 characters — full notes: https://github.com/navidrome/navidrome/releases/tag/v0.62.0]_