CVE-2026-47202

Name of the Vulnerable Software and Affected Versions Kavita versions prior to 0.9.0.2

Description An improper token validation flaw allows a remote and unauthenticated attacker to request a JSON Web Token (JWT)—a compact, URL-safe means of representing claims to be transferred between two parties—for any user, including administrators, provided the attacker knows the target username.

Recommendations Update to version 0.9.0.2.