CVE-2026-49220: Jellyfin Media Server XSS Vulnerability

CVE-2026-49220 Overview

CVE-2026-49220 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Jellyfin, an open source self-hosted media server. Versions prior to 10.11.9 accept arbitrary HTML and JavaScript in the Client header during an AuthenticateByName request. The injected payload is rendered later when an administrator visits the Access tab for the offending user from the dashboard. A non-privileged user can therefore execute JavaScript in the context of a logged-in administrator. The issue is fixed in Jellyfin 10.11.9.

Critical Impact
A low-privileged Jellyfin user can run arbitrary JavaScript in an administrator's authenticated session, enabling account takeover and full media server compromise.

Affected Products

Jellyfin media server versions prior to 10.11.9
Jellyfin administrative web dashboard (Access tab user view)
Self-hosted Jellyfin deployments exposing AuthenticateByName to untrusted users

Discovery Timeline

2026-06-24 - CVE-2026-49220 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-49220

Vulnerability Analysis

The vulnerability is a stored XSS issue in the Jellyfin user dashboard. When a user authenticates through the AuthenticateByName endpoint, the server records the value of the HTTP Client header alongside the session. The administrative dashboard later renders that value in the user's Access tab without proper HTML encoding. An attacker controls the Client header on their own authentication request, so they can persist HTML and JavaScript that fires whenever an administrator inspects their account.

Exploitation requires only valid low-privileged credentials and an administrator visit to the affected user's profile. The payload runs in the administrator's authenticated browser session, granting access to all dashboard functionality, including user management, plugin installation, and server configuration changes.

Root Cause

The root cause is missing output sanitization of an attacker-controlled HTTP header value rendered inside the administrative web UI. Jellyfin trusted the Client header string captured at authentication time and inserted it into the Access tab markup without contextual HTML escaping, violating standard XSS defense guidance for [CWE-79].

Attack Vector

The attack vector is network-based and requires the attacker to hold a non-administrative Jellyfin account. The attacker sends an AuthenticateByName request with a crafted Client header containing JavaScript. The payload is stored server-side. When an administrator opens the Access tab for that user from the dashboard, the browser executes the script under the administrator origin.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-fv79-gmhx-xh2v for technical details from the Jellyfin maintainers.

Detection Methods for CVE-2026-49220

Indicators of Compromise

AuthenticateByName requests containing <script>, onerror=, javascript:, or other HTML markup in the Client HTTP header.
Unusually long or encoded Client header values in Jellyfin access logs that deviate from known client identifiers such as Jellyfin Web, Jellyfin Android, or Jellyfin Mobile.
Administrator session activity such as new user creation, plugin installation, or API key generation immediately after a dashboard visit to a non-privileged user profile.

Detection Strategies

Parse Jellyfin reverse proxy or application logs for the Client header field and alert when the value contains HTML tags, angle brackets, or JavaScript event handlers.
Correlate administrator dashboard requests to /Users/{id} Access views with subsequent privileged API calls in a short time window.
Compare observed Client header values against an allowlist of legitimate Jellyfin client strings and flag anomalies for review.

Monitoring Recommendations

Forward Jellyfin and fronting web server logs to a centralized analytics platform for header-level inspection and historical search.
Monitor for outbound requests from administrator browsers to unknown domains shortly after dashboard navigation, which can indicate XSS payload callbacks.
Track changes to administrative settings, user roles, and installed plugins, and alert on modifications outside of approved change windows.

How to Mitigate CVE-2026-49220

Immediate Actions Required

Upgrade Jellyfin to version 10.11.9 or later on every server in the environment.
Audit existing users and inspect stored Client values for HTML or script content before exposing the Access tab.
Rotate administrator passwords and revoke active API keys created prior to patching if any suspicious Client headers are observed.

Patch Information

The vulnerability is fixed in Jellyfin 10.11.9. The maintainers added sanitization for the Client header value rendered in the administrative dashboard. Patch details and downloads are available in the Jellyfin GitHub Security Advisory GHSA-fv79-gmhx-xh2v.

Workarounds

Restrict Jellyfin user registration so that only trusted accounts can call AuthenticateByName until the patch is applied.
Avoid opening the Access tab for unfamiliar users from the administrative dashboard on unpatched servers.
Deploy a reverse proxy or web application firewall rule that rejects authentication requests where the Client header contains <, >, or javascript: substrings.

bash

# Example NGINX rule rejecting suspicious Client headers on the Jellyfin auth path
location /Users/AuthenticateByName {
    if ($http_client ~* "[<>]|javascript:|on[a-z]+=") {
        return 400;
    }
    proxy_pass http://jellyfin_backend;
}