CVE-2026-47202: Kavita: Pre-Auth Account Takeover
Kavita is a cross platform reading server. Prior to 0.9.0.2, an Improper Token validation flaw permits a remote and unauthenticated threat actor to request a JWT for any user including admins given knowledge of their username. This vulnerability is fixed in 0.9.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kavitato a version that resolves this vulnerability.Fixed in 0.9.0.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47202?
CVE-2026-47202 has a critical severity rating of 9.3 based on the CVSS scoring system.
How do I fix CVE-2026-47202?
To fix CVE-2026-47202, update Kavita to version 0.9.0.2 or later.
What type of vulnerability is CVE-2026-47202?
CVE-2026-47202 is an Improper Token Validation flaw that allows for pre-auth account takeover.
Who is affected by CVE-2026-47202?
CVE-2026-47202 affects all users of Kavita prior to version 0.9.0.2, including admins.
Can CVE-2026-47202 be exploited remotely?
Yes, CVE-2026-47202 can be exploited remotely and does not require authentication.