TS3 Manager CVE-2026-54253

Exploitation requires: (1) a victim who is a currently logged-in TS3 Manager operator with a valid session; (2) that victim to follow an attacker-crafted top-level link to the /api/download handler with a malicious port query parameter (UI:R - user interaction is mandatory); and (3) the vulnerable version prior to 2.2.6, which lacks a Content-Security-Policy header and does not sanitize the reflected port value. The maximum impact (full TeamSpeak server takeover) additionally requires that the targeted operator uses administrative ServerQuery credentials; otherwise only the operator's session/JWT is compromised. The attacker themselves needs no authentication. These factors - mandatory phishing of a privileged, authenticated user and dependence on the operator holding admin ServerQuery creds - meaningfully limit real-world exploitability.

This is a genuine but conditionally-gated risk, not a drive-by remote-code threat. The CVSS 8.2 is driven by S:C (the reflected script escapes into the manager's trusted browser origin) and C:H (theft of a JWT containing a CLEARTEXT ServerQuery password). However, exploitation is bounded by two facts the CVSS vector encodes correctly: UI:R (a logged-in operator must click an attacker-crafted top-level link) and the requirement that a valid operator session already exist. The PR:N is defensible because the ATTACKER needs no credentials - the burden of authentication falls on the victim. No EPSS score, no CISA KEV entry, and no public exploit code were provided, so there is no signal of active or automatable exploitation; this is a targeted social-engineering-dependent XSS, not a wormable flaw. The impact ceiling (full TeamSpeak server control) only materializes 'when the operator uses administrative ServerQuery credentials' - otherwise the disclosed JWT grants lesser access. Net: patch-worthy for anyone running TS3 Manager with admin ServerQuery creds, but real-world exploitation requires phishing a specific privileged operator, keeping practical risk moderate despite the high score. Source code confirms the vulnerability (unsanitized port reflected via res.send without CSP) and the fix (added CSP header + sanatizePort/sanatizeHostname), so the mechanism is verified, not merely claimed.

An attacker crafts a malicious link to the TS3 Manager's /api/download endpoint with a port query parameter containing HTML/JavaScript, then phishes a logged-in operator into clicking it. The reflected error message executes in the manager origin, reads the non-HttpOnly token cookie, and invokes the autofillform socket event to retrieve the decoded JWT - including the cleartext ServerQuery password - enabling session hijacking and control of the managed TeamSpeak server. No public exploit code was identified, but the patch diff publicly discloses the exact vulnerable sink and payload location.