CVE-2026-77386

44th percentile - higher than 44% of all known CVEs

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker could initiate the OIDC login flow with an attacker-controlled redirectUrl. The login handling in auth/oidc.go stored that URL with the opaque login state, and /auth/oidc/logged/{provider} appended the provider, token, and error values before redirecting the victim's browser without validating the destination. Because the one-use token was not bound to the browser session that initiated login, an attacker who induced a victim to complete OIDC authentication could capture the token at the attacker-controlled destination and exchange it through /auth/oidc/callback/{provider} for the victim's Kyoo session. This issue is fixed in version 5.1.0.

The vulnerability allows an attacker to hijack a victim's Kyoo session by capturing the OIDC token, potentially leading to unauthorized account and data access. Organizations using Kyoo with OIDC authentication are exposed to open redirect and session hijacking attacks.

Update Kyoo to version 5.1.0 or later, which fixes this vulnerability. Additionally, verify OIDC configuration and ensure allowed redirect URLs are strictly restricted.