CVE Catalog
CVE-2026-47202
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk0.17%
7th percentile - higher than 7% of all known CVEs
Summary
Improper token validation vulnerability in Kavita prior to 0.9.0.2. A remote, unauthenticated attacker can obtain a JWT for any user (including admins) given knowledge of their username.
Risk Assessment
An attacker can impersonate any user, including administrators, gaining full access to the system and data.
Recommendation
Update Kavita to version 0.9.0.2 or later.
Original NVD description (English source)
Kavita is a cross platform reading server. Prior to 0.9.0.2, an Improper Token validation flaw permits a remote and unauthenticated threat actor to request a JWT for any user including admins given knowledge of their username. This vulnerability is fixed in 0.9.0.2.