CVE-2026-77386Medium· 6.5▾ TwilightPoC availableKyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker could initiate the OIDC login flow with an attacker-controlled redirectUrl. The login handling in auth/oidc.go stored th…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 35.8 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Exploit / PoC code exists
Last analysed / modified upstream
0.4% → 0.6%
Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker could initiate the OIDC login flow with an attacker-controlled redirectUrl. The login handling in auth/oidc.go stored that URL with the opaque login state, and /auth/oidc/logged/{provider} appended the provider, token, and error values before redirecting the victim's browser without validating the destination. Because the one-use token was not bound to the browser session that initiated login, an attacker who induced a victim to complete OIDC authentication could capture the token at the attacker-controlled destination and exchange it through /auth/oidc/callback/{provider} for the victim's Kyoo session. This issue is fixed in version 5.1.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-77385Medium· 4.3Kyoo is a self-hosted media server focused on movies, series, and anime
CVE-2026-115537Medium· 4.3gedelumbung HospitalManagement URL Validation routing_pages.php simpan redirect
CVE-2026-112251Medium· 4.3antoinersx clawhost Reverse Proxy reverseProxy.ts handleRequest redirect
CVE-2026-112040Medium· 4.3diem-project diem Sign-In BasedmUserActions.class.php redirect
CVE-2026-112034Medium· 4.3aircheng-org iWebShop-5 Login Redirect _userInfo.php redirect
CVE-2026-111622Medium· 6.8smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter