Executive brief
Lyrion Music Server is a media streaming platform used to manage and play music across various devices. A security flaw in its logging interface allows attackers to trick users into clicking a malicious link that executes unauthorized code in their web browser. This could lead to unauthorized actions being performed on the user's behalf or the theft of sensitive session information within the application.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Lyrion Music Server version 9.2.0 and below. The vulnerability is located in the 'server.log' endpoint, where the 'search' parameter fails to properly neutralize user-supplied input before rendering it in the web page. An unauthenticated remote attacker can exploit this by crafting a malicious URL containing a JavaScript payload. When a victim visits this URL, the payload executes in the context of their browser session, potentially allowing for session hijacking or unauthorized configuration changes. The issue is tracked as CWE-79.
Affected products
- Lyrion Music Server 9.2.0 and earlier
Timeline
- 2026-06-05: disclosed: Initial disclosure by Zero Science Lab and VulnCheck
- 2026-06-05: advisory: CVE-2026-50230 published