CVE-2026-47202

9.3 Critique

Publiée le 26/05/2026 à 20:16 · Modifiée le 24/07/2026 à 13:10 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Kavita is a cross platform reading server. Prior to 0.9.0.2, an Improper Token validation flaw permits a remote and unauthenticated threat actor to request a JWT for any user including admins given knowledge of their username. This vulnerability is fixed in 0.9.0.2.

Traduire en français

Produits concernés

Kareadita Kavita

Scores CVSS

Version	Score	Source	Vecteur
4.0	9.3 Critique	security-advisories@github.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`

Faiblesses (CWE)

CWE-287
CWE-345
CWE-697

Références

https://github.com/Kareadita/Kavita/releases/tag/v0.9.0.2
https://github.com/Kareadita/Kavita/security/advisories/GHSA-m2v3-fcjh-hm22

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories