CVE-2026-62979High· 8.4▾ Twilightjack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, `middleware/handle-error.ts` serializes raw `FetchError` objects into HTTP responses. `lib/servers/base.ts` attaches outbound request …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, middleware/handle-error.ts serializes raw FetchError objects into HTTP responses. lib/servers/base.ts attaches outbound request headers on upstream non-success responses and schema-validation failures; the public extras field in lib/errors/FetchError.ts remains enumerable and is emitted by JSON serialization. These headers include the internal Radarr/Sonarr X-Api-Key and custom connector headers such as CF-Access-Client-Secret. lib/redact.ts redacts logs and spans but not this response path. Any client with the shared peer API key, plus Cloudflare Access credentials if required by the deployment, can force an error without a race or user interaction. GET /peer/items/:id and GET /servers/health can expose the internal media-server key, while GET /torznab/download/:id can expose another peer's key and Cloudflare Access secrets. The /peer/search and /items routes catch these errors and are not affected. Disclosed internal keys grant full administrative control of the corresponding Radarr/Sonarr instance, crossing the intended boundary between friends' shared peer access and private backend credentials. This issue is fixed in version 0.1.0.
jack < 0.1.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-13596NoneA sensitive information disclosure vulnerability exists in the error handling component of ATISoluciones CIGES Application version 2.15.6 and earlier
CVE-2022-31746Medium· 6.5Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header
CVE-2024-8612Low· 3.8Qemu-kvm: information leak in virtio devices
CVE-2023-29348High· 7.5Windows Remote Desktop Gateway (RD Gateway) Information Disclosure Vulnerability
CVE-2025-13647Medium· 5.8Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths
CVE-2024-38200Medium· 6.5Microsoft Office Spoofing Vulnerability