Executive brief
Concrete CMS, a popular content management system, is vulnerable to a security flaw where an administrator can inject malicious scripts into the name of an OAuth integration. If exploited, this could allow a rogue administrator to steal login credentials or other sensitive information from other users. This issue affects versions 9.5.0 and earlier and has been fixed in version 9.5.1.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in Concrete CMS versions 9.5.0 and below. The vulnerability is located in the OAuth authorize template, which renders the admin-controlled integration name using the t() translation helper. Because the HTML <strong> tags are built via PHP string interpolation before being passed to the translation helper, the integration name is rendered as raw HTML in the output. A remote attacker with high privileges (administrator) can inject malicious JavaScript into the integration name field. This script executes in the context of other users' sessions when they interact with the OAuth authorization flow, potentially allowing the attacker to snoop on login submissions or perform session hijacking. The issue is resolved in Concrete CMS 9.5.1.
Affected products
- Concrete CMS Concrete CMS <= 9.5.0
Timeline
- 2026-05-21: disclosed
- 2026-05-21: advisory
- 2026-05-21: patched: Fixed in version 9.5.1