OIDC Login Flow Vulnerability in Kyoo Media Server

CVE-2026-77386

What is CVE-2026-77386?

Kyoo, a self-hosted media server for movies, series, and anime, had a vulnerability in its OIDC login flow. An unauthenticated attacker could exploit this flaw by initiating the login process with a redirect URL of their choosing. The handling of login requests failed to validate the redirect destination properly, allowing the attacker to capture a one-use token intended for authenticated sessions. This token could be exchanged to gain unauthorized access to the victim's Kyoo session by redirecting them to an attacker-controlled URL. The issue has been addressed in version 5.1.0.

References