# CVE-2026-8197: Concrete CMS Stored XSS in OAuth integration name

Source: https://junglewise.ai/threats/cve-2026-8197-concrete-cms-stored-xss-in-oauth-integration-name  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-21. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-8197 · Severity: high · CVSS 4 · Published 2026-05-21

Concrete CMS, a popular content management system, is vulnerable to a security flaw where an administrator can inject malicious scripts into the name of an OAuth integration. If exploited, this could allow a rogue administrator to steal login credentials or other sensitive information from other users. This issue affects versions 9.5.0 and earlier and has been fixed in version 9.5.1.

Technologies: [Concrete CMS](https://junglewise.ai/threats/technologies/concrete-cms), [concrete5/concrete5 (Packagist)](https://junglewise.ai/threats/technologies/concrete5-concrete5). Vendors: [Concrete CMS](https://junglewise.ai/threats/vendors/concrete-cms), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-8197 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8197 being exploited in the wild.

**How severe is CVE-2026-8197?** High severity, with a CVSS score of 4, published 21 May 2026.

**Which products and versions are affected?** Concrete CMS <= 9.5.0, 9.5.0 and below; concrete5/concrete5 (Packagist) < 9.5.1, ECOSYSTEM:introduced=0,fixed=9.5.1.

**Is there a fix for CVE-2026-8197?** Yes. concrete5/concrete5 (Packagist): upgrade to 9.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8197 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-8197?** Check whether you run Concrete CMS or concrete5/concrete5 (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- concrete5/concrete5 (Packagist): upgrade to 9.5.1 or later

  ```sh
  composer require concrete5/concrete5:^9.5.1
  ```


## Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in Concrete CMS versions 9.5.0 and below. The vulnerability is located in the OAuth authorize template, which renders the admin-controlled integration name using the t() translation helper. Because the HTML <strong> tags are built via PHP string interpolation before being passed to the translation helper, the integration name is rendered as raw HTML in the output. A remote attacker with high privileges (administrator) can inject malicious JavaScript into the integration name field. This script executes in the context of other users' sessions when they interact with the OAuth authorization flow, potentially allowing the attacker to snoop on login submissions or perform session hijacking. The issue is resolved in Concrete CMS 9.5.1.

## Affected products

- Concrete CMS Concrete CMS <= 9.5.0

## Identifiers

- CVE-2026-8197
- GHSA-h72c-xx3w-w8h7

## Timeline

- 2026-05-21: disclosed
- 2026-05-21: advisory
- 2026-05-21: patched: Fixed in version 9.5.1

## References

- [https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes](https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes)

## Related threats

- [Concrete CMS OAuth REST API authorization bypass](https://junglewise.ai/threats/cve-2026-85387-concrete-cms-oauth-rest-api-authorization-bypass)
- [Concrete CMS unauthenticated Express entry search disclosure](https://junglewise.ai/threats/cve-2026-18120-concrete-cms-unauthenticated-express-entry-search-disclosure)
- [Concrete CMS REST API user creation permission bypass](https://junglewise.ai/threats/cve-2026-87031-concrete-cms-rest-api-user-creation-permission-bypass)
- [Concrete CMS access control bypass in board custom-slot preview](https://junglewise.ai/threats/cve-2026-87028-concrete-cms-access-control-bypass-in-board-custom-slot-preview)
- [Concrete CMS stored XSS via XML file upload in Form Block](https://junglewise.ai/threats/cve-2026-85386-concrete-cms-stored-xss-via-xml-file-upload-in-form-block)