Executive Summary

CVE-2026-47202 is a critical vulnerability in the Kavita reading server versions 0.9.0 and earlier. It involves an Improper Token Validation flaw that allows a remote, unauthenticated attacker to request a JSON Web Token (JWT) for any user, including administrators, if the attacker knows the username.

This means the attacker can completely take over any account without needing to authenticate or interact with the user.

The vulnerability is network-based, has low complexity to exploit, and results in high confidentiality and integrity loss.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to gain unauthorized access to any user account, including administrator accounts, on the Kavita server.

Such unauthorized access can lead to a complete account takeover, exposing sensitive data and potentially allowing the attacker to manipulate or steal information.

The impact includes a significant loss of confidentiality and integrity of data, although availability is not affected.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the Kavita application to version 0.9.0.2 or later, as this version contains the security hotfix addressing CVE-2026-47202.

Users running versions 0.9.0 and earlier are strongly advised to upgrade immediately to prevent unauthorized access and potential account takeover.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows a remote, unauthenticated attacker to take over any user account, including administrators, by requesting a JWT if the username is known. This leads to a complete account takeover without authentication, resulting in high confidentiality and integrity loss.

Such unauthorized access and potential data breaches could negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access.

Useful 0 Not Useful 0