CVE-2026-30924

CVE-2026-30924 affects qui, a web interface for qBittorrent instances up to version 1.14.1, due to a permissive Cross-Origin Resource Sharing (CORS) policy that reflects arbitrary origins while also returning credentials. This Critical (CVSS 9.0) vulnerability allows an attacker to trick a logged-in user into loading a malicious webpage, enabling authenticated requests on their behalf. The potential impact is severe, ranging from sensitive data exfiltration and API key compromise to full system compromise via the External Programs manager. Exploitation requires social engineering to lure a victim to an attacker-controlled page while they are accessing the application via a non-localhost hostname. Currently, there is no public exploit code available, nor any indication of active exploitation or significant community discussion.