CVE-2026-47202: Kavita Improper Authentication Allows JWT Issuance for Any User
Kavita versions before 0.9.0.2 contain an improper token validation flaw (CWE-287) that lets a remote, unauthenticated actor who knows a username request a JWT for that user, including administrators. The CNA rated it critical with a CVSS 4.0 base score of 9.3, and the description states it is fixed in 0.9.0.2. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.
Overview
Kavita is a cross-platform reading server. According to the record's description, versions before 0.9.0.2 contain an improper token validation flaw classified as CWE-287 (Improper Authentication). A remote, unauthenticated actor who knows a username can request a JWT for that user, including administrator accounts.
Impact
- The flaw may allow an unauthenticated actor to obtain a valid token for any user, including administrators.
- The CNA assigned a CVSS 4.0 base score of 9.3 (critical), with high confidentiality and integrity impact and low availability impact.
- The available text does not describe which data or functions become reachable after token issuance.
Affected products and versions
- Kavita versions prior to 0.9.0.2 are described as affected.
- The structured affected list in the record is empty, so the precise version boundaries beyond the description are unknown.
Exploitation status
The CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted for this analysis.
Remediation and mitigation
- Upgrade Kavita to version 0.9.0.2 or later, as stated in the description and the release notes.
- Review the GitHub security advisory for maintainer guidance.
- Until the upgrade is applied, restrict network exposure of the reading server, especially to untrusted networks.
- Review administrator accounts and recent token activity for unexpected access.
Detection guidance
- Review authentication logs for token issuance requests that do not match legitimate sign-ins, particularly for administrative accounts.
- Correlate unusual token requests from unfamiliar sources with subsequent account activity.
Limitations of the available information
- The record has no structured fixed-version or affected-version entries; the fix version comes from the description and the release reference.
- Technical details of the vulnerable code path and any proof-of-concept material are not included in the sources consulted, and are not described here.
- The EPSS figures are reported as recorded and are not interpreted further.
Frequently asked questions
Which Kavita versions are affected by this CVE?
The description states that versions prior to 0.9.0.2 are affected. The structured affected-version list in the record is empty, so no further version boundaries are confirmed.
Is this vulnerability being actively exploited?
The CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
What should administrators do first?
Upgrade Kavita to version 0.9.0.2 or later, review administrator accounts and token activity, and limit network exposure until the upgrade is complete.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.