Kavita, a cross‑platform reading server, contains an improper token validation flaw. Prior to release 0.9.0.2, a remote actor who is unauthenticated can obtain a JSON Web Token for any user, including administrators, simply by supplying the target username. This enables the attacker to assume the victim’s identity and access all of the user’s data, thereby compromising confidentiality and integrity of the account.

The vulnerability affects all versions of Kareadita’s Kavita service that precede version 0.9.0.2. No post‑0.9.0.2 releases are known to be impacted.

The CVSS base score of 9.3 reflects the high severity of this safety‑critical flaw. EPSS information is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by making unauthenticated HTTP requests to the token endpoint, for which the actor only needs the target username. As the flaw requires no additional privileges or local access, the exploitability of this vulnerability is high for remote attackers.