CVE-2026-47202CWE-287CWE-345CWE-697
Kavita: Pre-Auth Account Takeover
Critical · published May 26, 2026
What it is
Kavita is a cross platform reading server. Prior to 0.9.0.2, an Improper Token validation flaw permits a remote and unauthenticated threat actor to request a JWT for any user including admins given knowledge of their username. This vulnerability is fixed in 0.9.0.2.
The record
Technical detail
- CVSS v4.0
- 9.3 · CRITICAL
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
- EPSS
- 0.00223 · 12.2th percentile
- Weaknesses
- CWE-287 · Improper Authentication; CWE-345 · Insufficient Verification of Data Authenticity; CWE-697 · Incorrect Comparison
- Published
- 2026-05-26T17:30Z
EPSS history
Timeline