Critical· 9.3official fix available
CVE-2026-47202
CVE-2026-47202 is a critical vulnerability in Kavita (a cross-platform reading server) where improper token validation allows unauthenticated attackers to obtain JWTs for any user, including admins, by knowing their username. The flaw is fixed in version 0.9.0.2.
publishedMay 26, 2026
last modifiedJul 24, 2026
sourcesNVD
severity · cvss
9.3
critical · how bad it is
exploitation · epss
<1%
7th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 24, 2026
An official fix is available, so this entry is kept for 30 days and then removed automatically.
01
Who is affected
Users of Kavita versions prior to 0.9.0.2
02
Real-world impact
Attackers could impersonate users or access sensitive data without authentication
03
Why this severity
CVSS 9.3 (critical): High exploitability and severe impact due to remote code execution or privilege escalation risks
04
What to do about it
official fix available
recommended steps
- 01Upgrade Kavita to version 0.9.0.2 or later
- 02Verify the upgrade was applied successfully
NVD description
05
Timeline
- May 26, 2026 · May 26, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
- Jul 25, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Attack requirementsNone
Privileges requiredNone
User interactionNone needed
Confidentiality impactHigh
Integrity impactHigh
Availability impactLow
07
References & advisories
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →