Executive brief
ChurchCRM, an open-source church management system, contains a security flaw in its login page. An attacker can trick a user into clicking a malicious link that executes unauthorized code in their browser. This could allow the attacker to steal login credentials, hijack user sessions, or deface the login page to capture sensitive information.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in ChurchCRM's login component (CRM/src/session/index.php and begin-session.php). The application fails to sanitize or encode the 'username' URL parameter before echoing it into the 'value' attribute of the login form's input element. An unauthenticated remote attacker can exploit this by crafting a malicious URL and inducing a user to visit it. Successful exploitation allows for the execution of arbitrary JavaScript in the context of the victim's browser session, which can be used to exfiltrate session cookies or perform credential harvesting via DOM manipulation. The issue is resolved in version 7.1.0.
Affected products
- ChurchCRM CRM < 7.1.0
Timeline
- 2026-04-05: advisory: GitHub Security Advisory published
- 2026-04-07: disclosed: CVE published to NVD
- 2026-04-07: patched: Fix released in version 7.1.0