Executive brief
A web interface fails to properly encode user-supplied input from the request URL, allowing it to reflect directly into script context and hyperlink attributes without authentication. An attacker can craft a malicious link that, when clicked by a user, executes arbitrary JavaScript in the victim's browser session or redirects them to an external site. Successful exploitation compromises the user's session and could enable account takeover, unauthorized administrative actions, or data theft.
Technical details
This is a classic reflected cross-site scripting (XSS) and open redirect vulnerability in a web interface. The root cause is inadequate input validation and output encoding of URL parameters; the application reflects portions of the request URL into JavaScript code and HTML hyperlink attributes without sanitizing or encoding malicious characters. The vulnerability is unauthenticated and exploitable via network attack by crafting a phishing link. An attacker can execute arbitrary JavaScript in the victim's browser within the application's security context, potentially stealing session tokens, performing actions on behalf of the user, or redirecting to malicious external sites. No patch information is currently available.
Affected products
- <UNKNOWN>
Timeline
- 2026-09-11: disclosed