critical9.3
CVE-2026-47202
Kavita is a cross platform reading server.
Impact
Kavita is a cross platform reading server. Prior to 0.9.0.2, an Improper Token validation flaw permits a remote and unauthenticated threat actor to request a JWT for any user including admins given knowledge of their username. This vulnerability is fixed in 0.9.0.2.
Affected products
| Product | Affected versions |
|---|---|
| Kavita Is A Cross Platform Reading Server. | before 0.9.0.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.