Kavita vulnerabilities

Improper token validation vulnerability in Kavita prior to 0.9.0.2. A remote, unauthenticated attacker can obtain a JWT for any user (including admins) given knowledge of their username.

Kavita, a cross-platform reading server, has a vulnerability in download and size-check endpoints. A low-privileged user can access content from libraries they are not assigned to if they know the chapter, volume, or series IDs.

In Kavita prior to 0.9.0, the ReaderController.GetImage endpoint is decorated with [AllowAnonymous], allowing unauthenticated access to page images from any chapter in any library. The apiKey parameter is not validated, and entity IDs are sequential, enabling easy enumeration of all server content.