CVE-2025-5769: XSS
The authentication endpoint does not properly encode user-supplied input before rendering it within the web page. This lack of output encoding allows an attacker to inject malicious JavaScript payloads into the authentication flow, which are then executed by the victim's browser.
By exploiting this vulnerability, an attacker can redirect the user's browser to a malicious website, modify the content of the web page displayed to the user, or exfiltrate information from the browser. However, due to the implementation of the httpOnly flag on session-related sensitive cookies, session hijacking and similar attacks are not possible.
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to cause a victim to interact with malicious user-supplied input in the authentication flow. No attacker authentication is required, but victim interaction is required.
What can successful exploitation do?
Injected JavaScript can redirect the victim to a malicious website, alter content displayed in the authentication page, or exfiltrate information available to the browser. The impact can extend beyond the vulnerable component because the attack executes in the victim's browser context.
Can this vulnerability be used to steal session cookies?
The description states that session-related sensitive cookies use the httpOnly flag. As a result, session hijacking and similar attacks based on reading those cookies are not possible through this issue.