Kavita is a cross platform reading server. Prior to 0.9.0.2, an Improper Token validation flaw permits a remote and unauthenticated threat actor to request a JWT for any user including admins given knowledge of their username. This vulnerability is fixed in 0.9.0.2.
The error consists of improper JWT token validation (CWE-287, CWE-345, CWE-697) — the application does not sufficiently verify the identity of the entity requesting token issuance. A remote, unauthenticated attacker can send a request for a JWT token for any account by providing only the username. As a result, the server issues a valid token without checking whether the requester has the right to do so. The obtained token allows full authentication in the application with the privileges of the compromised account.
An attacker can take control of any account in the Kavita application, including administrator accounts, gaining full access to server management, library resources, and other users' data.
Update Kavita to version 0.9.0.2 or newer. Patch available in producer references: https://github.com/Kareadita/Kavita/releases/tag/v0.9.0.2
Kavita in versions prior to 0.9.0.2 (all platforms)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X