Vulnerability · Published Mar 20, 2026 · Assigned by GitHub_M

CVE-2026-32890Anchorr: Stored XSS in User Mapping dropdown allows unprivileged Discord users to exfiltrate all secrets via /api/config

Critical 9.7

In plain English

A critical-severity cross-site scripting in Anchorr from openVESSL. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)9.7Critical

Exploit odds (30 days)0.4%top 61.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. In versions 1.4.1 and below, a stored Cross-site Scripting (XSS) vulnerability in the web dashboard's User Mapping dropdown allows any unprivileged Discord user in the configured guild to execute arbitrary JavaScript in the Anchorr admin's browser. By chaining this with the GET /api/config endpoint (which returns all secrets in plaintext), an attacker can exfiltrate every credential stored in Anchorr which includes DISCORD_TOKEN, JELLYFIN_API_KEY, JELLYSEERR_API_KEY, JWT_SECRET, WEBHOOK_SECRET, and bcrypt password hashes without any authentication to Anchorr itself. This issue has been fixed in version 1.4.2.

Affected products (as reported)

Vendor	Product	Versions
openVESSL	Anchorr	< 1.4.2

Weakness: CWE-79, CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

https://github.com/openVESSL/Anchorr/security/advisories/GHSA-qpmq-6wjc-w28q x_refsource_CONFIRM
https://github.com/openVESSL/Anchorr/commit/d5ae67e5b455241274ed0072cf2db43a6eb3f0b2 x_refsource_MISC
https://github.com/openVESSL/Anchorr/releases/tag/v1.4.2 x_refsource_MISC