CVE-2026-47202

UNKNOWN 0.0

Kavita: Pre-Auth Account Takeover

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

5th

Kavita is a cross platform reading server. Prior to 0.9.0.2, an Improper Token validation flaw permits a remote and unauthenticated threat actor to request a JWT for any user including admins given knowledge of their username. This vulnerability is fixed in 0.9.0.2.

CWE	CWE-287 CWE-345 CWE-697
Vendor	kareadita
Product	kavita
Published	May 26, 2026
Last Updated	May 27, 2026

Stay Ahead of the Next One

Get instant alerts for kareadita kavita

Be the first to know when new unknown vulnerabilities affecting kareadita kavita are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Kareadita / Kavita

< 0.9.0.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Kareadita/Kavita/security/advisories/GHSA-m2v3-fcjh-hm22 github.com: https://github.com/Kareadita/Kavita/releases/tag/v0.9.0.2