Prior to Kyoo version 5.1.0, an attacker could initiate the OIDC authentication flow using a malicious redirect URL. The authentication handler stored the redirect without validation, allowing the attacker to capture the user’s token when the victim completed authentication. The attacker could then exchange that token for a Kyoo session, effectively hijacking the victim’s account. This flaw, an instance of CWE‑601, enables unauthorized access to a user’s media server without needing to compromise the server directly.

The vulnerability affects the Kyoo media server developed by zoriya. All releases before version 5.1.0 are compromised; version 5.1.0 and later contain the fix.

The CVSS score of 6.5 reflects a medium severity risk. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. Exploitation requires an unauthenticated attacker to persuade a victim to complete the OIDC flow with a crafted redirect URL. Because the one‑use token is not tied to the initiating browser session, the attacker can capture it and trade it for a valid Kyoo session, resulting in account takeover. The vulnerability does not provide remote code execution, but it permits hijacking of user sessions.