CVE-2026-54253

Name of the Vulnerable Software and Affected Versions TS3 Manager versions prior to 2.2.6

Description The /api/download endpoint in packages/server/routes/api.js improperly handles the port query parameter, passing it to the socket.connect(port, host) function and returning the resulting error message as text/html without a Content Security Policy. This allows a reflected value to execute in the manager origin when a logged-in operator follows a crafted link. Additionally, the token cookie in packages/ui/src/store/modules/query.js lacks HttpOnly, Secure, and SameSite attributes, enabling a script to read the token and trigger the autofillform() event in packages/server/socket.js. This event returns a decoded JSON Web Token (JWT), which may contain the cleartext ServerQuery password, potentially leading to operator-session hijacking and full control of the managed TeamSpeak server if administrative credentials are used. A valid operator session and user interaction are required for exploitation.

Recommendations Update to version 2.2.6.