CVE-2026-54253

Description

TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in packages/server/routes/api.js passes the attacker-controlled port query parameter to socket.connect(port, host) and returns the resulting error.message through res.status(400).send(error.message) as text/html without a Content Security Policy. When a logged-in operator follows a crafted top-level link, the reflected value executes in the manager origin. The token cookie set in packages/ui/src/store/modules/query.js lacks HttpOnly, Secure, and an explicit SameSite attribute, allowing the script to read the token and call the autofillform event in packages/server/socket.js. autofillform returns the decoded JWT, including the cleartext ServerQuery password, enabling operator-session hijacking and control of the managed TeamSpeak server when the operator uses administrative ServerQuery credentials. A valid operator session and user interaction are required. This issue is fixed in 2.2.6.

CVSS 3.1 breakdown

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

• https://github.com/joni1802/ts3-manager/commit/48df540786d2784c5d7b9bd55786d63e31288d07
• https://github.com/joni1802/ts3-manager/releases/tag/v2.2.6
• https://github.com/joni1802/ts3-manager/security/advisories/GHSA-3cgm-7p4g-gffj

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked