Executive brief
FastAdmin is an open-source web application framework that includes user authentication functionality. The login and registration pages accept a URL parameter intended to redirect users after successful authentication, but this parameter is not properly sanitized. An attacker can craft a malicious link that executes arbitrary JavaScript in the browser of anyone who clicks it, potentially allowing session hijacking, credential theft, or account takeover.
Technical details
FastAdmin versions up to 1.2.0.20210401_beta contain a reflected cross-site scripting (XSS) vulnerability in the user authentication module. The User.php controller retrieves a user-supplied url parameter using only a trim filter, with no HTML entity encoding, and passes it directly to the view template. The template renders this untrusted value without an encoding modifier into a double-quoted HTML attribute (e.g., `value="{$url}"`), allowing the quote character to pass through unescaped. An unauthenticated attacker can break out of the attribute context with a payload like `"><img src=x onerror=alert(1)>` and inject arbitrary script. The vulnerability is reachable by accessing the publicly available `/index/user/login.html` or `/index/user/register.html` endpoints. Fixed in version 1.2.1.20210731_beta (commit b3d32e2) by applying the htmlentities output modifier to template variables.
Affected products
- FastAdminNet FastAdmin up to 1.2.0.20210401_beta
Timeline
- 2026-07-21: disclosed: Public disclosure and proof-of-concept published
- 2026-09-07: advisory: CVE-2026-86244 published in NVD
- 2026-07-31: patched: Fix released in version 1.2.1.20210731_beta via commit b3d32e2