Executive brief
Kyoo is a self-hosted media server for movies, series, and anime. Prior to version 5.1.0, an attacker could hijack user login sessions by redirecting users to a malicious site after they authenticate through OpenID Connect. If a victim completes login, the attacker can capture the authentication token and take over their Kyoo account without needing to know their password.
Technical details
The vulnerability is an open redirect flaw in the OIDC login flow: the /auth/oidc endpoint accepts an attacker-controlled redirectUrl parameter and stores it with the opaque login state, then /auth/oidc/logged/{provider} redirects to that URL with the token appended without validation. The authentication token is not bound to the browser session initiating login, allowing an attacker to intercept it at their controlled destination and exchange it via /auth/oidc/callback/{provider} for a valid victim session. The fix whitelists permissible redirect URLs via environment configuration.
Affected products
- Kyoo Kyoo before 5.1.0
Timeline
- 2026-09-18: disclosed
- 2026-07-11: patched: Fix merged in commit 02ab3af via PR #1576