CVE-2026-49220

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-49220
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-49220.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-49220
Aliases
  • GHSA-fv79-gmhx-xh2v
Published
2026-06-24T18:23:04.925Z
Modified
2026-06-26T11:56:00.032728231Z
Severity
  • 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Jellyfin: Potential XSS in user management
Details

Jellyfin is an open source self hosted media server. Prior to 10.11.9, a potential XSS attack exists in Jellyfin which can allow a non-privileged user to execute arbitrary Javascript in the context of a logged-in Administrative user, resulting in numerous potential issues. The Client header during an AuthenticateByName can contain arbitrary HTML and Javascript, which will then be executed by the Administrative user when visiting the Access tab of the user in question from within the dashboard. This vulnerability is fixed in 10.11.9.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49220.json",
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/jellyfin/jellyfin

Affected ranges

Type
GIT
Repo
https://github.com/jellyfin/jellyfin
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e83a7e62f26443f7dd98f126d6955ac1af090125
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "10.11.9"
        }
    ]
}

Affected versions

v10.*
v10.0.0
v10.0.1
v10.0.2
v10.11.0
v10.11.0-rc1
v10.11.0-rc2
v10.11.0-rc3
v10.11.0-rc4
v10.11.0-rc5
v10.11.0-rc6
v10.11.0-rc7
v10.11.0-rc8
v10.11.0-rc9
v10.11.1
v10.11.2
v10.11.3
v10.11.4
v10.11.5
v10.11.6
v10.11.7
v10.11.8
v10.4.0
v10.5.0
v10.6.0
v10.8.0-alpha1
v10.8.0-alpha2
v10.8.0-alpha3
v10.8.0-alpha4
v10.8.0-alpha5
v3.*
v3.5.2-5

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-49220.json"