CVE-2026-50235: Lyrion Music Server 9.2.0 Reflected XSS in Advanced Search

Technical summary

This reflected XSS vulnerability (CWE-79) exists in Lyrion Music Server 9.2.0's advanced search functionality. The application fails to properly sanitize or encode user-supplied search parameters before rendering them back in the HTML response. An attacker can inject arbitrary JavaScript payloads through URL-based search parameters. Because the payload is reflected directly into the response without output encoding, the JavaScript executes in the victim's browser within the security context of the Lyrion server domain. The CVSS 3.1 score of 6.1 (MEDIUM) reflects network accessibility, low attack complexity, and requirement for user interaction, with consequent impact to confidentiality and integrity but no availability impact.

Business impact

Session hijacking is the primary risk. An attacker stealing a user's session token can gain unauthorized access to that user's Lyrion Music Server account, potentially accessing, modifying, or deleting music libraries, playlists, and personal metadata. In environments where Lyrion is integrated with broader music distribution or library management workflows, compromised sessions could disrupt service availability or expose sensitive information. The attack surface is wider in shared or public-facing deployments where users may be more likely to click unfamiliar links. Reputational damage may occur if users' listening habits or library data are exposed.

Affected systems

Lyrion Music Server version 9.2.0 is confirmed affected. Organizations running this specific version should prioritize assessment. Versions prior to or after 9.2.0 are not explicitly identified in available advisories; verify against vendor documentation or release notes for confirmed scope. Deployments exposed to untrusted networks or with users who access the server via shared or public links face higher risk.

Exploitability

Exploitation is straightforward and requires no authentication, special privileges, or complex configuration. An attacker simply constructs a URL with malicious JavaScript in search parameters and distributes it via email, social media, or other channels. User interaction is required—the victim must follow the link—but social engineering is often effective, especially if the link appears to come from a trusted source or is embedded in legitimate-looking communications. No special tools beyond a web browser are needed. The attack is reliably repeatable across victims who click the same malicious link.

Remediation

Upgrade Lyrion Music Server to a patched version released after 9.2.0. Consult the official Lyrion project repository or vendor advisories for confirmed fixed versions. As an interim mitigation, restrict access to the Lyrion server to trusted networks or implement a Web Application Firewall (WAF) rule to detect and block requests containing common XSS payloads in search parameters. Additionally, educate users to verify links before clicking, especially those referencing search functionality.

Patch guidance

Contact the Lyrion project maintainers or consult their official release notes to identify the specific patched version addressing CVE-2026-50235. Once a patch is available, test it in a non-production environment before rolling out to ensure compatibility with your music library, plugins, and dependent services. Apply the patch during a maintenance window to minimize disruption. Verify that advanced search functionality operates normally post-patch and that no regression occurs in other features.

Detection guidance

Monitor web access logs for search requests containing encoded or obfuscated JavaScript patterns (e.g., script tags, event handlers like 'onerror=', 'onclick=', or data URIs) in query parameters. Implement browser-based Content Security Policy (CSP) headers on the Lyrion server to restrict inline script execution and limit script sources. Enable user-agent logging to correlate suspicious search requests with potential session theft patterns. Look for unusual account activity, such as library modifications or access from unexpected geographies or IP addresses correlated with the timing of detected XSS attempts.

Why prioritize this

Although the CVSS score is MEDIUM and the vulnerability requires user interaction, XSS vulnerabilities should not be underestimated. Session theft directly compromises user accounts and can enable lateral movement or data exfiltration in integrated environments. The low complexity of exploitation and the high likelihood of successful social engineering in real-world scenarios mean that even moderate CVSS scores warrant timely patching. Prioritize if the Lyrion server handles sensitive music metadata, is accessible externally, or if users are frequent targets of phishing campaigns.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects a MEDIUM severity rating. The score accounts for network attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and requirement for user interaction (UI:R). The scope is changed (S:C), meaning the attacker can impact resources beyond the vulnerable component (user session and browser). Confidentiality and integrity are both impacted (C:L, I:L), as session tokens can be stolen and actions forged. Availability is not impacted (A:N). The relatively moderate score reflects the practical barrier of requiring user interaction, but does not diminish the real-world risk posed by session compromise in production environments.

Frequently asked questions