CVE-2026-54253

Overview

TS3 Manager prior to version 2.2.6 contains a vulnerability in the /api/download handler involving improper handling of attacker-controlled parameters. This flaw allows malicious scripts to execute within the manager origin and access sensitive authentication tokens due to missing cookie flags. It ultimately enables operator-session hijacking and compromise of managed TeamSpeak servers through administrative ServerQuery credentials.

Description

TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in packages/server/routes/api.js passes the attacker-controlled port query parameter to socket.connect(port, host) and returns the resulting error.message through res.status(400).send(error.message) as text/html without a Content Security Policy. When a logged-in operator follows a crafted top-level link, the reflected value executes in the manager origin. The token cookie set in packages/ui/src/store/modules/query.js lacks HttpOnly, Secure, and an explicit SameSite attribute, allowing the script to read the token and call the autofillform event in packages/server/socket.js. autofillform returns the decoded JWT, including the cleartext ServerQuery password, enabling operator-session hijacking and control of the managed TeamSpeak server when the operator uses administrative ServerQuery credentials. A valid operator session and user interaction are required. This issue is fixed in 2.2.6.

Impact

The vulnerability impacts confidentiality and integrity by exposing authentication tokens and cleartext ServerQuery passwords to unauthorized scripts. Authenticated operators are the primary targets, as exploitation requires user interaction via a crafted link. Successful exploitation leads to total control over the managed TeamSpeak server infrastructure.

Remediation

Upgrade TS3 Manager to version 2.2.6 or later to resolve the parameter handling flaw and secure cookie attributes. Ensure proper Content Security Policy headers are enforced across the web interface. Review operator sessions and rotate administrative ServerQuery credentials if compromise is suspected.

Risk context

The vulnerability is rated as high severity with a CVSS v3 score of 8.2, reflecting significant potential impact despite requiring user interaction and a valid operator session. The current EPSS score is 0.00035, indicating a very low observed probability of exploitation in the wild at this time.

Affected products

• TS3 Manager < 2.2.6