Threats affecting pkg:github/kareadita/Kavita

CVE-2026-47202 is a critical improper authentication vulnerability in Kavita versions prior to 0.9.0.2. It allows a remote unauthenticated attacker to request a JSON Web Token (JWT) for any user, including administrators, if the attacker knows the username. This flaw stems from improper token validation. The vulnerability has a high CVSS 4.0 score of 9.3, indicating severe impact. A fix is available in version 0.

Kavita is a cross platform reading server. Prior to 0.9.0, the download, size-check, and chapter metadata endpoints do not enforce library-level authorization. A low-privileged user who knows or guesses a chapterId, volumeId, or seriesId belonging to a library they are not assigned to can download the full file contents, query file sizes, and read metadata for that content. This affects /api/Download/volume-size, /api/Download/chapter-size, /api/Download/series-size, /api/Download/volume, /api/Download/chapter, /api/Download/series, and /api/Chapter. This vulnerability is fixed in 0.9.0.

Kavita versions prior to 0.9.0 have a vulnerability where the ReaderController. GetImage endpoint allows unauthenticated access to page images from any chapter in any library. The endpoint accepts an apiKey parameter but does not validate it, enabling attackers to enumerate all content due to sequential entity IDs. This issue is fixed in version 0.9.0.