SecBoard
Zurück zur CVE-Übersicht

CVE-2026-77386

MEDIUM(6.5)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Risk Signal Score16/100 — NIEDRIG
  • CVSS 6.5 — Mittel

EPSS-Score

0.6%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

6.5

Technische Schwere

Beschreibung

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker could initiate the OIDC login flow with an attacker-controlled redirectUrl. The login handling in auth/oidc.go stored that URL with the opaque login state, and /auth/oidc/logged/{provider} appended the provider, token, and error values before redirecting the victim's browser without validating the destination. Because the one-use token was not bound to the browser session that initiated login, an attacker who induced a victim to complete OIDC authentication could capture the token at the attacker-controlled destination and exchange it through /auth/oidc/callback/{provider} for the victim's Kyoo session. This issue is fixed in version 5.1.0.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 5.1.0

Threat-Hunting-Queries

Detection for OIDC login flows with suspicious redirect URLs. This requires logging of web server access logs that include full request URLs.

Sentinel/Defender KQL

let SuspiciousOidcRedirects = (Timeframe:timespan=24h) {
  CommonSecurityLog
  | where TimeGenerated >= ago(Timeframe)
  | where DeviceProduct == "Kyoo"
  | where RequestURL has_all ("/auth/oidc/login/", "redirectUrl=")
  | extend RedirectUrl = extract(@"redirectUrl=([^&]+)", 1, RequestURL)
  | where RedirectUrl !startswith "http://127.0.0.1" and RedirectUrl !startswith "http://localhost"
  | where RedirectUrl !startswith "https://app.example.com" // Customize with legitimate redirect URLs
  | summarize count() by SourceIP, RequestURL, RedirectUrl
  | where count_ > 5 // Adjust threshold as needed
};
SuspiciousOidcRedirects()

Splunk SPL

sourcetype=kyoo_access_logs "/auth/oidc/login/" "redirectUrl="
| rex "redirectUrl=(?P<RedirectUrl>[^&]+)"
| where NOT (RedirectUrl LIKE "http://127.0.0.1%" OR RedirectUrl LIKE "http://localhost%" OR RedirectUrl LIKE "https://app.example.com%")
| stats count by clientip, uri, RedirectUrl
| where count > 5

Sigma

title: Kyoo OIDC Redirect URL Abuse
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects suspicious OIDC redirect URLs in Kyoo access logs that could indicate an attempt to capture login tokens.
author: SecBoard
date: 2026/07/12
logsource:
  category: webserver
  product: kyoo
detection:
  selection:
    url|contains: '/auth/oidc/login/'
    url|contains: 'redirectUrl='
  filter_legitimate_redirects:
    url|contains:
      - 'http://127.0.0.1'
      - 'http://localhost'
      - 'https://app.example.com' # Customize with legitimate redirect URLs
  condition: selection and not filter_legitimate_redirects
fields:
  - client_ip
  - url
  - redirect_url
falsepositives:
  - Legitimate third-party clients not whitelisted.
level: medium

Elastic ES|QL

FROM kyoo_access_logs
| WHERE url LIKE '/auth/oidc/login/%' AND url LIKE '%redirectUrl=%'
| GROK url, 'redirectUrl=%{RedirectUrl}[^&]*'
| WHERE NOT (RedirectUrl LIKE 'http://127.0.0.1%' OR RedirectUrl LIKE 'http://localhost%' OR RedirectUrl LIKE 'https://app.example.com%')
| STATS count() BY client_ip, url, RedirectUrl
| WHERE count > 5

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Domains (1)

  • attacker.example

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Referenzen