PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47202 Kareadita CVE debrief

A critical authentication bypass vulnerability in Kavita, a cross-platform reading server, allows remote unauthenticated attackers to obtain valid JWT tokens for any user—including administrators—by knowing only the target username. The flaw stems from improper token validation (CWE-287, CWE-345, CWE-697) in versions prior to 0.9.0.2. Successful exploitation grants full administrative access to the affected instance without requiring any credentials. The vulnerability was disclosed on May 26, 2026, with a fix released in version 0.9.0.2. Organizations running Kavita should prioritize upgrading to the patched version immediately, as this vulnerability enables complete account takeover with minimal attacker effort.

Vendor
Kareadita
Product
Kavita
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-05-26
Advisory published
2026-05-26
Advisory updated
2026-05-26

Who should care

Organizations and individuals self-hosting Kavita reading server instances, particularly those with administrative accounts managing sensitive content libraries. Security teams responsible for application security in media server environments. DevOps practitioners managing Kavita deployments who need to prioritize patching schedules.

Technical summary

Kavita versions prior to 0.9.0.2 contain an improper token validation vulnerability that allows remote unauthenticated attackers to request valid JWT authentication tokens for arbitrary user accounts, including administrative accounts, with knowledge of only the target username. The vulnerability is classified under CWE-287 (Improper Authentication), CWE-345 (Insufficient Verification of Data Authenticity), and CWE-697 (Incorrect Comparison). The CVSS 4.0 score of 9.3 reflects network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts to confidentiality and integrity. The vulnerability was fixed in Kavita version 0.9.0.2 released on May 26, 2026.

Defensive priority

critical

Recommended defensive actions

  • Upgrade Kavita to version 0.9.0.2 or later immediately to remediate the improper token validation vulnerability
  • Review authentication logs for suspicious JWT token requests or unauthorized administrative access prior to patching
  • Invalidate all existing JWT tokens and force re-authentication for all users after upgrading to prevent use of attacker-obtained tokens
  • Implement network segmentation to restrict Kavita instance access to authorized users only until patching is complete
  • Monitor for unauthorized account access attempts, particularly for administrative accounts, as indicators of potential exploitation

Evidence notes

Vulnerability description and CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N) confirm network-exploitable, unauthenticated access with high confidentiality and integrity impact. CWE-287 (Improper Authentication), CWE-345 (Insufficient Verification of Data Authenticity), and CWE-697 (Incorrect Comparison) identified as root causes. Fix version 0.9.0.2 confirmed via vendor release notes.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-47202 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-47202

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-47202 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-47202

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.