Tautulli versions between 1.3.10 and before 2.17.0 contain a flaw where the JSONP callback parameter is not sanitized. An attacker can remotely supply malicious callback content that is returned directly to the client, enabling cross‑origin script injection. The injected script can read the user's authentication token or API key, granting the attacker full access to administrative functions and sensitive media data.

The vulnerability affects installations of Tautulli from release 1.3.10 up to, but not including, version 2.17.0. Any environment running the vulnerable build that exposes the JSONP endpoint (typically the web interface) is at risk.

The vulnerability carries a CVSS score of 7.4, indicating a high severity level. The EPSS score is not available, but the lack of public exploitation references implies a moderate exploitation probability. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Attackers can exploit the flaw by constructing a specially crafted request to the JSONP endpoint exposed over HTTP/HTTPS, leading to script execution in the context of authorized users.