CVE-2026-54253: TS3 Manager: Reflected XSS via /api/download port parameter steals operator session
TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in packages/server/routes/api.js passes the attacker-controlled port query parameter to socket.connect(port, host) and returns the resulting error.message through res.status(400).send(error.message) as text/html without a Content Security Policy. When a logged-in operator follows a crafted top-level link, the reflected value executes in the manager origin. The token cookie set in packages/ui/src/store/modules/query.js lacks HttpOnly, Secure, and an explicit SameSite attribute, allowing the script to read the token and call the autofillform event in packages/server/socket.js. autofillform returns the decoded JWT, including the cleartext ServerQuery password, enabling operator-session hijacking and control of the managed TeamSpeak server when the operator uses administrative ServerQuery credentials. A valid operator session and user interaction are required. This issue is fixed in 2.2.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TS3 Managerto a version that resolves this vulnerability.Fixed in 2.2.6 - Configuration
Update the token cookie configuration in packages/ui/src/store/modules/query.js to include HttpOnly and Secure and set an explicit SameSite attribute so the reflected XSS cannot read the token from JavaScript.
packages/ui/src/store/modules/query.js (token cookie) HttpOnly/Secure/SameSite attributes = Set HttpOnly=true, Secure=true, and an explicit SameSite attribute - Configuration
Fix packages/server/routes/api.js /api/download so the attacker-controlled port query parameter is not passed directly into socket.connect(port, host), preventing reflected XSS via the error.message returned by res.status(400).send(error.message).
packages/server/routes/api.js (/api/download) port query parameter handling = Do not pass attacker-controlled port parameter to socket.connect(port, host); validate/limit allowed values - Configuration
Add a Content Security Policy (CSP) on the /api/download error response path that returns res.status(400).send(error.message) to reduce the impact of reflected XSS.
packages/server/routes/api.js (/api/download) response headers Content Security Policy (CSP) = Add a Content Security Policy to the response
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
TS3 Manager versions prior to 2.2.6 are affected. Exploitation is relevant where an operator is logged in and uses administrative ServerQuery credentials for a managed TeamSpeak server.
What does an attacker need to exploit it?
An attacker can send a crafted top-level link to an authenticated operator. The operator must follow the link; no attacker authentication is required.
What can an attacker obtain or do after successful exploitation?
The injected script can read the operator token cookie and invoke the autofillform event to obtain a decoded JWT containing the cleartext ServerQuery password. This can enable operator-session hijacking and control of the managed TeamSpeak server.
What should teams do if they cannot upgrade immediately?
The provided data identifies version 2.2.6 as the fix, but does not provide a supported workaround. Until upgraded, reduce exposure by preventing operators from following untrusted links while logged in and avoid using administrative ServerQuery credentials where possible.