zoriya Kyoo up to 5.0.x OIDC Login auth/oidc.go redirectUrl

Summaryinfo

A vulnerability was found in zoriya Kyoo up to 5.0.x. It has been rated as problematic. This affects an unknown part of the file auth/oidc.go of the component OIDC Login. Performing a manipulation of the argument redirectUrl results in redirect. This vulnerability was named CVE-2026-77386. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic has been found in zoriya Kyoo up to 5.0.x. This affects an unknown function of the file auth/oidc.go of the component OIDC Login. The manipulation of the argument redirectUrl with an unknown input leads to a redirect vulnerability. CWE is classifying the issue as CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. This is going to have an impact on integrity. The summary by CVE is:

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker could initiate the OIDC login flow with an attacker-controlled redirectUrl. The login handling in auth/oidc.go stored that URL with the opaque login state, and /auth/oidc/logged/{provider} appended the provider, token, and error values before redirecting the victim's browser without validating the destination. Because the one-use token was not bound to the browser session that initiated login, an attacker who induced a victim to complete OIDC authentication could capture the token at the attacker-controlled destination and exchange it through /auth/oidc/callback/{provider} for the victim's Kyoo session. This issue is fixed in version 5.1.0.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-77386 since 08/20/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1204.001 for this issue.

Upgrading to version 5.1.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• zoriya

Name

• Kyoo

Version

• 5.0

Website

• Product: https://github.com/zoriya/Kyoo/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion