CVE-2026-49154 | music-assistant server up to 2.9.8 OAuth Callback oauth_callback.html WebserverController._handle_auth_callback return_url cross site scripting (GHSA-5fch-fp25-3g2p)

October 20, 2026 Yanac

A vulnerability marked as problematic has been reported in music-assistant server up to 2.9.8. This vulnerability affects the function WebserverController._handle_auth_callback of the file oauth_callback.html of the component OAuth Callback Handler. This manipulation of the argument return_url causes cross site scripting.

This vulnerability is registered as CVE-2026-49154. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More