What is the CVSS score of CVE-2026-49220?

CVE-2026-49220 has a CVSS 3.1 base score of 5.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-49220?

Yes, a patch is available for CVE-2026-49220. Update the affected software to the latest version immediately.

Jellyfin CVE-2026-49220

EUVD-2026-39031 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-24 GitHub_M

XSS Jellyfin

5.7

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.7 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.3 MEDIUM

PR:L for required account; UI:R for mandatory admin navigation; I:L added over vendor vector because admin-context JS execution enables state-changing actions beyond confidentiality.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 24, 2026 - 20:03 EUVD

Analysis Generated

Jun 24, 2026 - 19:22 vuln.today

DescriptionCVE.org

Jellyfin is an open source self hosted media server. Prior to 10.11.9, a potential XSS attack exists in Jellyfin which can allow a non-privileged user to execute arbitrary Javascript in the context of a logged-in Administrative user, resulting in numerous potential issues. The Client header during an AuthenticateByName can contain arbitrary HTML and Javascript, which will then be executed by the Administrative user when visiting the Access tab of the user in question from within the dashboard. This vulnerability is fixed in 10.11.9.

AnalysisAI

Stored XSS in Jellyfin's administrative dashboard allows a low-privileged user to execute arbitrary JavaScript in the browser context of a logged-in administrator. The Client header supplied during an AuthenticateByName API request is stored without sanitization and rendered unescaped when an administrator visits the Access tab of that user's profile in the dashboard. Affecting all versions prior to 10.11.9, successful exploitation could enable admin session hijacking, credential exfiltration, or unauthorized administrative actions; no public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Jellyfin is an open-source, self-hosted media server (CPE: cpe:2.3:a:jellyfin:jellyfin:*:*:*:*:*:*:*:*). The vulnerability resides in the AuthenticateByName API endpoint, which accepts a Client header as authentication metadata identifying the calling client application. This header value is persisted server-side but rendered into the administrative dashboard's Access tab HTML output without proper output encoding, constituting a stored (persistent) XSS as classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The root cause is a missing sanitization or output-encoding step between the storage layer and the dashboard's HTML rendering layer - a classic stored XSS pattern where untrusted input traverses from API ingestion to privileged UI output without transformation.

RemediationAI

Upgrade to Jellyfin 10.11.9, which contains the vendor-confirmed fix per the security advisory at https://github.com/jellyfin/jellyfin/security/advisories/GHSA-fv79-gmhx-xh2v. If immediate upgrade is not feasible, administrators should avoid navigating to the Access tab of user profiles in the dashboard until the patch is applied, as this is the specific trigger surface. As an additional compensating control, restricting administrative dashboard access to trusted internal networks or a VPN reduces the attack window by limiting which principals can both submit malicious Client headers and induce admin review of those entries. Audit server logs for anomalous or HTML-containing values in the Client authentication header field to detect prior exploitation attempts.