EUVD-2026-39031Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
PR:L for required account; UI:R for mandatory admin navigation; I:L added over vendor vector because admin-context JS execution enables state-changing actions beyond confidentiality.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
Jellyfin is an open source self hosted media server. Prior to 10.11.9, a potential XSS attack exists in Jellyfin which can allow a non-privileged user to execute arbitrary Javascript in the context of a logged-in Administrative user, resulting in numerous potential issues. The Client header during an AuthenticateByName can contain arbitrary HTML and Javascript, which will then be executed by the Administrative user when visiting the Access tab of the user in question from within the dashboard. This vulnerability is fixed in 10.11.9.
AnalysisAI
Stored XSS in Jellyfin's administrative dashboard allows a low-privileged user to execute arbitrary JavaScript in the browser context of a logged-in administrator. The Client header supplied during an AuthenticateByName API request is stored without sanitization and rendered unescaped when an administrator visits the Access tab of that user's profile in the dashboard. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a low-privileged Jellyfin account sufficient to issue an `AuthenticateByName` API request (PR:L per CVSS vector) - full authentication success may not be required if the `Client` header is persisted on failed attempts, but this is unconfirmed from available data. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.7 (Medium) score reflects the key mitigating factors: PR:L (an authenticated low-privileged account is required to submit the crafted header) and UI:R (an administrator must actively navigate to the targeted user's Access tab before the payload fires). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privileged Jellyfin account submits an `AuthenticateByName` HTTP request where the `Client` header contains a JavaScript payload such as a script that beacons the admin's session cookie to an attacker-controlled server. When a Jellyfin administrator later opens the dashboard and navigates to the Access tab for that user's profile, the stored payload executes in the admin's browser, silently exfiltrating the session token. … |
| Remediation | Upgrade to Jellyfin 10.11.9, which contains the vendor-confirmed fix per the security advisory at https://github.com/jellyfin/jellyfin/security/advisories/GHSA-fv79-gmhx-xh2v. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Jellyfin is a Free Software Media System for managing and streaming media. Rated high severity (CVSS 8.8), this vulnerab
In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality. Rated high severity (
Jellyfin is a free-software media system. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, lo
Jellyfin up to v10.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /Repositories. R
Jellyfin is a system for managing and streaming media. Rated high severity (CVSS 7.2), this vulnerability is remotely ex
Jellyfin is a Free Software Media System. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable,
Remote code execution as root in Jellyfin media server versions prior to 10.11.7 allows authenticated users with 'Upload
Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple ap
jellyfin-web is the web client for Jellyfin, a free-software media system. Rated medium severity (CVSS 5.4), this vulner
In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS. Rated medium severity (CVSS 5.4),
In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS. Rated medium severity (CVSS 5.4
In Jellyfin before 10.8, stored XSS allows theft of an admin access token. Rated medium severity (CVSS 5.4), this vulner
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today