CVE-2026-32890 Cross-site scripting in Anchorr
Unprivileged Discord users can execute JavaScript in admin browsers via stored XSS to steal all API keys and secrets from the Anchorr dashboard.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-32890?
CVE-2026-32890 is a critical cross-site scripting vulnerability in openVESSL Anchorr, published on 20 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. In versions 1.4.1 and below, a stored Cross-site Scripting (XSS) vulnerability in the web dashboard's User Mapping dropdown allows any unprivileged Discord user in the configured guild to execute arbitrary JavaScript in the Anchorr admin's browser. By chaining this with the GET /api/config endpoint (which returns all secrets in plaintext), an attacker can exfiltrate every credential stored in Anchorr which includes DISCORD_TOKEN, JELLYFIN_API_KEY, JELLYSEERR_API_KEY, JWT_SECRET, WEBHOOK_SECRET, and bcrypt password hashes without any authentication to Anchorr itself. This issue has been fixed in version 1.4.2.
Which versions are affected by CVE-2026-32890?
It affects 1 product.
Products include Openvessl Anchorr.
How do I fix CVE-2026-32890?
No fix has been published for CVE-2026-32890 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-32890 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32890 exists.
Other vulnerabilities in openVESSL Anchorr
Sources
Also known as GHSA-qpmq-6wjc-w28q.