CVE-2026-50235: Lyrion Music Server XSS Vulnerability

CVE-2026-50235 Overview

CVE-2026-50235 is a reflected cross-site scripting (XSS) vulnerability in Lyrion Music Server version 9.2.0. The flaw resides in the advanced search functionality, which fails to sanitize user-supplied input before reflecting it in search forms. Attackers can craft malicious URLs containing JavaScript payloads in search parameters. When a victim clicks the link, the injected script executes in the browser under the application's origin. This enables session token theft, credential harvesting, and unauthorized actions against the music server interface. The vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact

Attackers can execute arbitrary JavaScript in authenticated users' browsers, steal session information, and perform actions on behalf of the victim against the Lyrion Music Server interface.

Affected Products

• Lyrion Music Server 9.2.0
• Advanced search component reflecting unsanitized parameters
• Web interface served by vulnerable installations

Discovery Timeline

• 2026-06-05 - CVE-2026-50235 published to NVD
• 2026-06-05 - Last updated in NVD database

Technical Details for CVE-2026-50235

Vulnerability Analysis

Lyrion Music Server 9.2.0 exposes a web interface that includes an advanced search feature. The application accepts user-supplied search terms through URL parameters and reflects those values back into the rendered HTML of the search form. The reflected values are not HTML-encoded or otherwise sanitized before being written to the response body. An attacker can therefore inject script tags or event-handler attributes that the browser parses and executes.

Exploitation requires user interaction. A victim must visit a crafted URL while authenticated to the music server. Once the payload executes, it operates within the security context of the application's origin. Attackers can read session cookies, exfiltrate stored credentials, manipulate playback configuration, or pivot to additional internal endpoints reachable from the victim's browser.

Root Cause

The root cause is missing output encoding on search parameter values within the advanced search response. The application trusts client-supplied data and concatenates it into HTML output without applying contextual escaping. This pattern matches [CWE-79], where input that crosses a trust boundary is not neutralized before being rendered.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker delivers a crafted link through phishing email, chat, forum posts, or a malicious website. When the targeted user, who must be authenticated to a vulnerable Lyrion Music Server, follows the link, the injected JavaScript executes in their browser session. See the VulnCheck Security Advisory and Zero Science Vulnerability Report ZSL-2026-5993 for parameter-level technical details.

No verified public exploit code is referenced in the advisory. The vulnerability manifests by appending script content to vulnerable search parameters in the advanced search endpoint, then luring an authenticated user to load the resulting URL.

Detection Methods for CVE-2026-50235

Indicators of Compromise

• HTTP requests to the Lyrion Music Server advanced search endpoint containing <script>, onerror=, onload=, or javascript: substrings in query parameters.
• URL-encoded payload patterns such as %3Cscript%3E, %3Cimg, or %22%3E%3C appearing in search parameter values.
• Outbound browser requests from authenticated user sessions to attacker-controlled domains immediately following access to a search URL.
• Unexpected session activity originating from user accounts shortly after they clicked an external link to the music server.

Detection Strategies

• Inspect web server and reverse proxy access logs for requests to the search endpoint containing HTML tags or JavaScript event handlers in parameters.
• Deploy a Web Application Firewall (WAF) rule set that flags reflected XSS signatures against the Lyrion Music Server hostname.
• Correlate referer headers pointing to external domains with subsequent suspicious requests on internal management endpoints.

Monitoring Recommendations

• Enable verbose access logging on the Lyrion Music Server and forward logs to a centralized analytics platform for query-string inspection.
• Monitor browser endpoint telemetry for script execution originating from the music server origin that contacts unrecognized external hosts.
• Alert on phishing campaigns referencing internal media server URLs and review user clickthrough events.

How to Mitigate CVE-2026-50235

Immediate Actions Required

• Restrict access to the Lyrion Music Server web interface to trusted internal networks and require VPN access for remote users.
• Instruct users not to click search or media links delivered through unsolicited messages.
• Apply a reverse proxy filter that strips or encodes HTML control characters in query parameters destined for the search endpoint.

Patch Information

No vendor patch is referenced in the available advisories at the time of NVD publication on 2026-06-05. Administrators should monitor the VulnCheck Security Advisory and Zero Science Vulnerability Report ZSL-2026-5993 for updates and apply vendor fixes when released.

Workarounds

• Place the Lyrion Music Server behind a WAF configured with reflected XSS signatures and block requests containing HTML tags in search parameters.
• Enforce a strict Content-Security-Policy response header that disallows inline scripts and untrusted script sources on the music server origin.
• Require browser users to log out of administrative sessions before browsing external content and use a dedicated browser profile for the music server interface.
• Disable or restrict the advanced search feature for unauthenticated or low-trust user roles until a vendor patch is available.

# Example NGINX reverse proxy rule to block obvious XSS payloads in search parameters
location /search {
    if ($args ~* "(<|%3C)\s*script|onerror=|onload=|javascript:") {
        return 403;
    }
    proxy_pass http://lyrion_backend;
}