Jellyfin EUVD-2026-39031

The attacker must hold a low-privileged Jellyfin account sufficient to issue an AuthenticateByName API request (PR:L per CVSS vector) - full authentication success may not be required if the Client header is persisted on failed attempts, but this is unconfirmed from available data. Additionally, a Jellyfin administrator must actively navigate to the Access tab of the targeted user's profile within the administrative dashboard (UI:R); passive browsing of the dashboard does not trigger the payload. Exploitation is limited to Jellyfin deployments where non-admin user accounts exist and administrators regularly review individual user access records. No special server configuration beyond a default Jellyfin installation is required. What limits exploitation: the mandatory admin interaction step (UI:R) prevents fully automated or passive exploitation; an attacker cannot force an administrator to visit the specific tab.

The CVSS 5.7 (Medium) score reflects the key mitigating factors: PR:L (an authenticated low-privileged account is required to submit the crafted header) and UI:R (an administrator must actively navigate to the targeted user's Access tab before the payload fires). These prerequisites materially constrain opportunistic mass exploitation. The High confidentiality impact (C:H) is justified by admin session hijacking potential, but I:N in the vendor-provided vector likely understates the real-world integrity risk - JavaScript executing in the admin's browser context could also perform state-changing administrative actions (user deletion, configuration changes), warranting at minimum I:L. No EPSS score was provided in the source data, precluding probability-based comparison. No CISA KEV listing exists, and no public POC has been identified, indicating this is not currently exploited at scale. For internet-exposed or multi-tenant Jellyfin instances, the admin-targeting nature elevates practical urgency beyond what the numerical CVSS score alone conveys. One notable ambiguity: the description states 'non-privileged user' can exploit this, yet the CVSS vector specifies PR:L - it is unclear whether the Client header is persisted even for failed authentication attempts; if so, the effective privilege floor may be lower than PR:L and should be verified against the vendor advisory.

An attacker with a low-privileged Jellyfin account submits an AuthenticateByName HTTP request where the Client header contains a JavaScript payload such as a script that beacons the admin's session cookie to an attacker-controlled server. When a Jellyfin administrator later opens the dashboard and navigates to the Access tab for that user's profile, the stored payload executes in the admin's browser, silently exfiltrating the session token. No public proof-of-concept has been identified, but the attack requires only basic HTTP manipulation skills and is straightforward to reproduce from the description alone.