Kyoo
Monthly
Unvalidated OIDC redirect handling in the Kyoo self-hosted media server before 5.1.0 lets an unauthenticated attacker capture a victim's one-use login token and exchange it for that victim's Kyoo session. The attacker starts the OIDC login flow with an attacker-controlled redirectUrl; because the pre-fix code stored that URL alongside the opaque login state and appended the token, provider, and error values to it without validating the destination or binding the token to the browser session that began the flow, a social-engineered victim who completes authentication at their identity provider has the token delivered to the attacker's host, where it can be replayed through /auth/oidc/callback/{provider}. CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) - network reachable and requiring no privileges or authentication, but gated on victim user interaction and on the instance having at least one OIDC provider configured and enabled; no public exploit identified at time of analysis.
Missing catalog-level authorization in the Kyoo self-hosted media server before 5.1.0 lets an authenticated user who holds the core.play permission read uncataloged files beneath the media directory by submitting a base64-encoded filesystem path to the transcoder API. The flaw is a CWE-639 authorization bypass through a user-controlled key, and exploitation requires both a privileged account and knowledge or successful guessing of the target path, which confines the assessed impact to low-confidentiality, read-only disclosure inside the SafePath subtree. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is a genuine but modest-severity authorization defect rather than an emergency.
Unvalidated OIDC redirect handling in the Kyoo self-hosted media server before 5.1.0 lets an unauthenticated attacker capture a victim's one-use login token and exchange it for that victim's Kyoo session. The attacker starts the OIDC login flow with an attacker-controlled redirectUrl; because the pre-fix code stored that URL alongside the opaque login state and appended the token, provider, and error values to it without validating the destination or binding the token to the browser session that began the flow, a social-engineered victim who completes authentication at their identity provider has the token delivered to the attacker's host, where it can be replayed through /auth/oidc/callback/{provider}. CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) - network reachable and requiring no privileges or authentication, but gated on victim user interaction and on the instance having at least one OIDC provider configured and enabled; no public exploit identified at time of analysis.
Missing catalog-level authorization in the Kyoo self-hosted media server before 5.1.0 lets an authenticated user who holds the core.play permission read uncataloged files beneath the media directory by submitting a base64-encoded filesystem path to the transcoder API. The flaw is a CWE-639 authorization bypass through a user-controlled key, and exploitation requires both a privileged account and knowledge or successful guessing of the target path, which confines the assessed impact to low-confidentiality, read-only disclosure inside the SafePath subtree. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is a genuine but modest-severity authorization defect rather than an emergency.