Executive brief
A security vulnerability exists in the Altenar Sportsbook Software Platform, a system used for managing online sports betting. An attacker can send a specially crafted link to a user that, when clicked, allows the attacker to run malicious code in the user's browser. This could lead to the theft of login credentials, session tokens, or other sensitive personal information.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Altenar Sportsbook Software Platform (SB2) v2.0. The application's JavaScript dynamically generates an iframe using user-controlled input from the 'url' GET parameter without proper validation or sanitization. By crafting a URL using 'javascript:' or 'data:' URI schemes, an attacker can bypass intended logic to execute arbitrary JavaScript within the context of the victim's browser session. This vulnerability is triggered via an open redirect vector where the input is assigned to the iframe's 'src' attribute and appended to the 'streamContainer' element. Successful exploitation requires a victim to click a malicious link, potentially leading to session hijacking or credential theft.
Affected products
- Altenar Sportsbook Software Platform (SB2) 2.0
Timeline
- 2026-04-10: disclosed
- 2026-04-10: advisory