CVE-2026-47202 Overview
Kavita is a cross-platform reading server used to host and manage digital libraries. CVE-2026-47202 is an authentication bypass vulnerability caused by improper JSON Web Token (JWT) validation in versions prior to 0.9.0.2. A remote, unauthenticated attacker who knows a valid username can request a JWT for that account, including administrator accounts. Successful exploitation grants full account takeover without credentials or user interaction. The flaw is categorized under CWE-287: Improper Authentication and is fixed in Kavita 0.9.0.2.
Critical Impact
A remote unauthenticated attacker can mint a valid JWT for any Kavita user, including administrators, leading to full instance takeover.
Affected Products
- Kavita reading server versions prior to 0.9.0.2
- Self-hosted Kavita instances exposed to untrusted networks
- Kavita deployments where administrator usernames are guessable or publicly known
Discovery Timeline
- 2026-05-26 - CVE-2026-47202 published to NVD
- 2026-05-26 - Last updated in NVD database
Technical Details for CVE-2026-47202
Vulnerability Analysis
The vulnerability resides in Kavita's authentication workflow, where the server issues JWTs without enforcing proper credential validation. According to the GitHub Security Advisory GHSA-m2v3-fcjh-hm22, an attacker only needs to submit a username to receive a signed token for that identity. The returned JWT is accepted by downstream API endpoints as proof of authentication. This collapses the trust boundary between unauthenticated and authenticated users into a single piece of low-entropy data: the username.
Because Kavita exposes administrative functionality through the same API surface, an attacker holding an admin JWT can manage users, libraries, server settings, and stored content. The flaw maps to CWE-287: Improper Authentication and is exploitable over the network with low complexity.
Root Cause
The root cause is missing credential verification during JWT issuance. The token-generation path treats a username as a sufficient identity claim instead of binding the token to a successful password or multi-factor authentication step. No secret-knowledge proof is required from the requester.
Attack Vector
The attack vector is network-based and unauthenticated. An attacker who can reach the Kavita HTTP API enumerates or guesses a username, such as admin, and requests a JWT. The server returns a signed token bound to that account. The attacker then attaches the token to subsequent API requests to act as the targeted user. No user interaction is required, and no prior foothold is needed.
No verified public proof-of-concept code is available at this time. Refer to the Kavita v0.9.0.2 release notes and the upstream advisory for technical details.
Detection Methods for CVE-2026-47202
Indicators of Compromise
- Unexpected successful API calls authenticated as administrator accounts from unfamiliar source IP addresses.
- Creation, modification, or deletion of Kavita user accounts without a corresponding administrator login event.
- Configuration changes, library additions, or bulk content access initiated outside normal administrative hours.
- Repeated requests to the Kavita authentication or token endpoint with varying username values.
Detection Strategies
- Monitor Kavita web server logs for token-issuance requests followed immediately by privileged API calls from the same client.
- Alert on JWTs presented from IP addresses that have never previously authenticated interactively to the application.
- Compare administrator action logs against successful credential-based login events to identify tokens that lack a matching authentication step.
Monitoring Recommendations
- Forward Kavita application and reverse-proxy access logs to a centralized logging platform for retention and correlation.
- Track the version banner of internet-exposed Kavita instances and flag any host still reporting a release below 0.9.0.2.
- Establish a baseline of administrator API usage and alert on deviations such as new IPs, user agents, or off-hours activity.
How to Mitigate CVE-2026-47202
Immediate Actions Required
- Upgrade all Kavita instances to version 0.9.0.2 or later without delay.
- Remove direct internet exposure of the Kavita API until patching is complete, restricting access to a VPN or trusted network.
- Rotate all Kavita user passwords and invalidate existing sessions and tokens after upgrading.
- Review audit logs for signs of unauthorized administrator activity dating back to the deployment of any vulnerable version.
Patch Information
The maintainers fixed CVE-2026-47202 in Kavita 0.9.0.2. Patch artifacts and release notes are published on the Kavita Release v0.9.0.2 page. Coordinated disclosure details are available in the GitHub Security Advisory GHSA-m2v3-fcjh-hm22.
Workarounds
- Place Kavita behind a reverse proxy that enforces an additional authentication layer such as HTTP basic auth or single sign-on.
- Restrict inbound network access to the Kavita port using firewall rules or an IP allowlist until the upgrade is applied.
- Rename default or predictable administrator usernames to reduce the success rate of username guessing, while treating this only as a temporary measure.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
