CVE-2026-47202 — Kavita: Pre-Auth Account Takeover
Kavita is a cross platform reading server. Prior to 0.9.0.2, an Improper Token validation flaw permits a remote and unauthenticated threat actor to request a JWT for any user in…
Published: 2026-05-26 · CVSS: 9.3 · CVSS 4.0
Kavita is a cross platform reading server. Prior to 0.9.0.2, an Improper Token validation flaw permits a remote and unauthenticated threat actor to request a JWT for any user including admins given knowledge of their username. This vulnerability is fixed in 0.9.0.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7