CVE-2026-50230 Scanner

Lyrion Music Server is a widely used software by music enthusiast communities and small-scale web radio stations, aimed at providing streaming music services and managing audio libraries. It is frequently deployed in environments where users can interact and share music collections in real-time. Often, such servers are implemented in schools, libraries, and community centers to foster shared listening experiences and educational explorations of music. Its core function revolves around delivering seamless audio content streaming and managing playlists on various scales. As music servers become integral to public and private collections, maintaining their security becomes paramount, especially in preventing unauthorized actions.

Cross-Site Scripting (XSS) vulnerabilities allow attackers to execute arbitrary scripts in a victim's browser within certain web applications. In the case of Lyrion Music Server, it uploads unchecked scripts into the server.log endpoint via improper sanitization. This leads to vulnerabilities where attackers can execute scripts, potentially giving them control over a user session, which can result in severe security breaches depending on session data accessible by those scripts. This vulnerability is often exploited to perform actions on behalf of users or steal sensitive information such as session cookies that enable impersonation and privilege escalation.

The vulnerability in Lyrion Music Server centers around the server.log endpoint, specifically through the 'search' parameter. This parameter allows JavaScript execution due to lack of validation and sanitization, which attackers exploit to include scripts like "". When a user accesses the log with the vulnerable parameter, the script executes in their browser, allowing attackers to conduct malicious activities, such as session hijacking. The process involves sending specific payloads via HTTP requests and then leveraging the browser's response to infer additional information or manipulate further system interactions.

Exploiting this vulnerability can result in severe security risks including stolen session cookies, which provide immediate access to user accounts and services without credentials. Attackers can impersonate users, manipulate account settings, or perform unwanted operations on behalf of the victim user. When exploited, it disrupts the integrity and confidential nature of user interactions with the application, posing a significant risk in environments where sensitive data might be transmitted or utilized.

REFERENCES

• https://www.zeroscience.mk/#/advisories/ZSL-2026-5988
• https://nvd.nist.gov/vuln/detail/CVE-2026-50230
• https://www.lyrion.org