← Database

CVE-2023-23636

MEDIUM CVSS: 5.4 Published: 2023-02-03 Modified: 2026-06-17

Description

In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage of the victim.

Affected Platforms

Jellyfin Jellyfin

Weakness Type

CWE-79, CWE-79

References