Executive brief
Jellyfin is an open-source media server used to organize and stream personal media collections. A security flaw allows a standard user to inject malicious scripts that target system administrators. If an administrator views the affected user's profile, the script could execute, potentially allowing the attacker to access sensitive administrative information or perform actions on the administrator's behalf.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in Jellyfin due to improper sanitization of the 'Client' header during the 'AuthenticateByName' process. An authenticated, non-privileged attacker can supply a malicious payload within this header. The payload is subsequently executed in the browser of an administrative user when they navigate to the 'Access' tab of the attacker's account within the dashboard. This allows for arbitrary JavaScript execution in the context of the administrator's session, which could lead to unauthorized data access. The issue is resolved in version 10.11.9 by implementing improved sanitization of the Client header.
Affected products
- Jellyfin Jellyfin < 10.11.9
Timeline
- 2026-06-10: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: NVD publication date