Skip to content
OpenAdvisories

Vendor

zoriya

2 known vulnerabilities.

Products

Kyoo 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-77386

    Kyoo: OIDC login token can be redirected to an attacker-controlled URL

    Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker could initiate the OIDC login flow with an attacker-controlled redirectUrl. The login handling in auth/oidc.go stored that URL with the opaque…

    zoriya Kyoo
  • Medium 4.3
    CVE-2026-77385

    Kyoo: Transcoder serves uncataloged files from the media directory

    Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned t…

    zoriya Kyoo