Kavita Improper Token Validation Vulnerability Allowing Pre-Authenticated Account Takeover

A critical vulnerability has been identified in Kavita reading server versions prior to 0.9.0.2. This vulnerability allows remote, unauthenticated users to request a JSON Web Token (JWT) for any user, including administrators, by knowing their username. The issue arises from improper validation of tokens, enabling unauthorized access to user accounts.

Impact

Exploitation of this vulnerability allows for pre-authentication account takeover, where an attacker can gain unauthorized access to user accounts, including those of administrators, by requesting JWTs for these accounts.

Remediation

Users are advised to update to Kavita version 0.9.0.2 or later, where this vulnerability has been fixed.