CVE-2026-50231: Lyrion Music Server 9.2.0 Unauthenticated Stored XSS in Log Viewer

Technical summary

The vulnerability is a stored XSS (CWE-79) flaw in Lyrion Music Server 9.2.0's log viewer functionality. Unauthenticated attackers can exploit unescaped template variables by submitting malicious JavaScript through the query parameters 'search', 'lines', and 'path', or by controlling logged values such as User-Agent headers, stream titles, or player names. Because the injected scripts are persisted in logs and executed client-side when logs are viewed, any user accessing the log viewer becomes a potential victim. The attack vector is network-based with low complexity and requires no privilege or user interaction beyond viewing a crafted or compromised log entry.

Business impact

A successful exploit allows attackers to execute arbitrary JavaScript in the context of users' Lyrion Music Server web interface sessions. This can lead to session hijacking, credential theft, malware distribution, defacement of the music server interface, or lateral movement into the organization's network if users also access other internal systems from the same browser. For music streaming deployments in business or shared environments, this could disrupt service availability and compromise user trust. The unauthenticated nature of the attack significantly increases exposure.

Affected systems

Lyrion Music Server version 9.2.0 is affected. Organizations running this version should inventory deployments, particularly any instances exposed to untrusted networks or accessible from user devices. The vulnerability does not appear to affect other vendor products based on available information, but affected organizations should verify their exact deployment versions against vendor advisories.

Exploitability

The vulnerability is relatively straightforward to exploit. An attacker can craft a malicious URL containing XSS payloads in the search, lines, or path parameters, or can supply crafted values that get logged (such as a stream title or device name containing JavaScript). Since no authentication is required and the attack triggers on log viewer access, the barrier to exploitation is low. However, the attack depends on a victim user visiting the log viewer, which is a minor practical constraint in many deployments.

Remediation

Apply patches from Lyrion Music Server as soon as they become available. Until patching is possible, limit access to the log viewer to trusted users only, restrict network access to the music server's web interface using firewall rules or VPN requirements, and disable or remove the log viewer feature if it is not essential to operations. Sanitize and escape all template variables in the log viewer before rendering them in HTML context.

Patch guidance

Consult the official Lyrion Music Server security advisory and release notes for patched versions addressing CVE-2026-50231. Verify the patch version number against the vendor's official sources. Test patches in a non-production environment before deployment. Given the high CVSS score and unauthenticated attack vector, prioritize patching within 1–2 weeks depending on your environment's exposure risk.

Detection guidance

Monitor web server logs for suspicious log viewer access patterns, including requests with unusual characters or script-like syntax in the 'search', 'lines', or 'path' parameters. Look for logged values (User-Agent, stream titles, player names) that contain HTML or JavaScript tags. Implement Content Security Policy (CSP) headers to restrict inline script execution. Monitor user sessions for unexpected activity following log viewer access. Intrusion detection systems tuned for XSS patterns may catch malicious payloads in query strings or logged metadata.

Why prioritize this

This vulnerability earns high priority due to its CVSS 7.2 score, unauthenticated attack surface, and potential for widespread impact across all log viewer users. The stored nature of the XSS means the payload persists and affects any future user who views the logs, creating a 'blast radius' that extends beyond a single session. For organizations with music servers accessible from user networks or the internet, this should be treated as urgent.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH) reflects: network-accessible attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), no user interaction needed for the attack itself (UI:N), scope change (S:C) allowing impact beyond the vulnerable application, and low impact on confidentiality and integrity (C:L, I:L). The absence of availability impact (A:N) prevents a higher score, but the combination of unauthenticated access, ease of exploitation, and cross-site execution capability justifies the HIGH severity rating.

Frequently asked questions