CVE-2026-50230 is a reflected cross-site scripting vulnerability in LMS Community's Lyrion Music Server 9.2.0. The issue exists in the server.log endpoint where the search parameter is improperly neutralized, allowing injection of arbitrary HTML and JavaScript code. This vulnerability is unauthenticated and can be triggered by sending a specially crafted URL to a user, causing script execution in their browser under the application's context. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low scope impact.

Successful exploitation allows an attacker to execute arbitrary scripts in the victim's browser within the context of the Lyrion Music Server application. This can lead to theft of user session data, manipulation of displayed content, or other actions permitted by the victim's privileges in the application. However, the vulnerability requires user interaction (clicking a malicious link) and does not require authentication. There are no reports of active exploitation.

No official patch or remediation is currently available from the vendor. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until a fix is released, users should exercise caution when clicking on URLs related to the Lyrion Music Server, especially those containing the server.log endpoint with search parameters. Implementing web application firewalls or input validation proxies may help mitigate risk temporarily.