CVE-2026-49220: Jellyfin XSS Vulnerability via Client Header (CVSS 5.7)

Technical summary

CVE-2026-49220 is a stored XSS vulnerability (CWE-79) in the Jellyfin authentication mechanism. The vulnerability exists in the AuthenticateByName endpoint, where the Client header parameter fails to properly sanitize or escape user-supplied input. When a non-privileged user authenticates with a crafted Client header containing JavaScript or HTML payloads, this malicious content is persisted and later rendered unsanitized in the administrative dashboard—specifically within the Access tab of the user management interface. An administrator visiting this tab triggers execution of the injected script in their security context, enabling privilege escalation and unauthorized system manipulation.

Business impact

For Jellyfin deployments in production environments, this vulnerability poses a significant insider threat risk. A non-privileged user or external attacker with basic authentication credentials can compromise administrative accounts without detection, leading to unauthorized system reconfiguration, data exfiltration from the media library, or lateral movement within the hosting network. In multi-tenant or shared hosting scenarios, an attacker could gain administrative control over the entire media server and its content distribution. Additionally, compromised admin credentials expose authentication tokens and session data that may extend beyond the Jellyfin instance itself.

Affected systems

Jellyfin versions prior to 10.11.9 are affected. This includes all deployments running 10.11.8 and earlier, whether self-hosted on-premises, in containers, or in cloud environments. The vulnerability requires the attacker to have at least non-privileged user credentials, so fully public or unauthenticated Jellyfin instances are not directly at risk from this specific vector. However, any installation that permits user registration or allows multiple user accounts is potentially vulnerable.

Exploitability

Exploitability is straightforward. The attack requires only network access and valid non-privileged user credentials—no authentication bypass is needed. The Client header is a standard HTTP header that can be manipulated in any HTTP client, making the payload delivery trivial. However, the attack requires social engineering or administrative negligence (visiting the compromised user's Access tab), placing it in the 'low to medium' practical exploitability range. Once the payload is injected during authentication, it persists until the user record is purged or the dashboard is never accessed by an admin, making detection difficult.

Remediation

Upgrade Jellyfin to version 10.11.9 or later immediately. This version includes input sanitization and output encoding fixes that prevent the Client header from being interpreted as executable code. Organizations should prioritize patching, particularly for publicly accessible or internet-facing Jellyfin instances. Prior to patching, restrict administrative access to trusted personnel only and monitor authentication logs for suspicious Client header values or unusual user creation patterns.

Patch guidance

Download and install Jellyfin 10.11.9 from the official Jellyfin release page. For container deployments, pull the updated image tag (verify the specific version in your container repository). For source installations, rebuild from the patched commit. After patching, restart all Jellyfin services and verify connectivity. No database migrations are required. Test administrative dashboard access, particularly the user management and Access tabs, to ensure the patch is functioning correctly.

Detection guidance

Monitor HTTP logs for AuthenticateByName requests containing suspicious Client header values, such as those with HTML tags, script tags, or JavaScript keywords. Review Jellyfin authentication logs for unusual user account creation or modification patterns. Check the dashboard access logs for administrative users accessing the user management or Access tabs shortly after unusual authentication events. Conduct a forensic review of existing user records to identify any previously injected payloads in the Client header field. If available, enable verbose logging in Jellyfin to capture full HTTP headers during authentication requests.

Why prioritize this

While the CVSS score of 5.7 reflects medium severity, the practical risk is elevated due to the potential for privilege escalation and administrative compromise. Any Jellyfin instance with multiple users or external user access should prioritize this patch. The attack's ease of execution (simple header manipulation) combined with its potential impact (full administrative control) justifies accelerated patching timelines, particularly in production environments.

Risk score, explained

The CVSS 3.1 score of 5.7 (MEDIUM) reflects an attack vector that requires network access and low privileges (PR:L), relies on user interaction (UI:R), and is scoped to the application itself (S:U). While the attack requires an admin to visit a specific dashboard section, the confidentiality impact is high (C:H), as the attacker can steal authentication tokens, session cookies, or sensitive configuration data. The attack scope does not extend beyond the Jellyfin application, and there is no direct integrity or availability impact from the script execution alone, which moderates the score. In practice, however, the ability to execute arbitrary code in an admin's browser context creates significant post-exploitation opportunities.

Frequently asked questions