# CVE-2024-26318: Serenity cross-site scripting in login page return URL

Source: https://junglewise.ai/threats/cve-2024-26318-serenity-cross-site-scripting-in-login-page-return-url  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-02-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-26318 · Severity: low · CVSS 3.1 · Published 2024-02-19

Serenity is a web application development framework used to build business applications. The framework's login page accepted arbitrary return URLs from email links without proper validation, allowing attackers to craft phishing emails that execute malicious scripts when users clicked them. This could lead to credential theft, session hijacking, or malware distribution. The issue was remediated in version 6.8.0 by restricting return URLs to local paths only.

Technologies: [Serenity.Net.Core (NuGet)](https://junglewise.ai/threats/technologies/serenity-net-core). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2024-26318 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-26318 being exploited in the wild.

**How severe is CVE-2024-26318?** Low severity, with a CVSS score of 3.1, published 19 February 2024.

**Which products and versions are affected?** @serenity-is/corelib (npm) SEMVER:introduced=0,fixed=6.8.0; Serenity.Net.Core (NuGet) ECOSYSTEM:introduced=0,fixed=6.8.0; Serenity Corelib before 6.8.0.

**Is there a fix for CVE-2024-26318?** Yes. @serenity-is/corelib (npm): upgrade to 6.8.0 or later; Serenity.Net.Core (NuGet): upgrade to 6.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-26318 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-26318?** Check whether you run @serenity-is/corelib (npm), Serenity.Net.Core (NuGet) or Serenity Corelib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @serenity-is/corelib (npm): upgrade to 6.8.0 or later

  ```sh
  npm install @serenity-is/corelib@6.8.0
  ```

- Serenity.Net.Core (NuGet): upgrade to 6.8.0 or later

  ```sh
  dotnet add package Serenity.Net.Core --version 6.8.0
  ```


## Technical details

This is a reflected cross-site scripting (CWE-79) vulnerability in the LoginPage.tsx component of Serenity. The root cause is insufficient validation of the return URL parameter passed to the login page, which was previously accepted regardless of its origin. An attacker can craft a malicious email containing a login link with a return URL pointing to an external domain or containing JavaScript (e.g., javascript: protocol or data: URI), which the page would redirect to or execute after authentication. The attack vector is primarily email-based social engineering combined with network access to the application. The fix validates that return URLs must begin with a forward slash (/), ensuring they point to internal application paths only. All versions before 6.8.0 are affected, across both the NuGet Serenity.Net.Core package and the npm @serenity-is/corelib package.

## Affected products

- Serenity Serenity.Net.Core before 6.8.0
- Serenity @serenity-is/corelib before 6.8.0

## Identifiers

- CVE-2024-26318
- GHSA-5jjq-8cvj-v6m9

## Timeline

- 2024-02-19: disclosed
- 2023-08-14: patched: Fix released in version 6.8.0

## References

- [https://github.com/serenity-is/Serenity](https://github.com/serenity-is/Serenity)
- [https://serenity.is/docs/release-notes/6.8.0](https://serenity.is/docs/release-notes/6.8.0)

## Related threats

- [User account enumeration in Serenity](https://junglewise.ai/threats/cve-2023-31286-user-account-enumeration-in-serenity)
- [Insufficient token expiration in Serenity](https://junglewise.ai/threats/cve-2023-31287-insufficient-token-expiration-in-serenity)
- [Cross Site Scripting (XSS) in Serenity](https://junglewise.ai/threats/cve-2023-31285-cross-site-scripting-xss-in-serenity)