Stored XSS Vulnerability in Jellyfin Media Server 10.8.x and Earlier Versions

CVE-2023-23635

What is CVE-2023-23635?

In Jellyfin versions 10.8.0 to 10.8.3, a stored cross-site scripting vulnerability exists in the handling of collection names. This oversight enables malicious actors to inject scripts that can extract sensitive data, such as access tokens from users' local storage. When victims interact with the compromised elements, their data could be accessed without authorization, posing significant risks to their privacy and account security.

References