CVE-2026-19876: Reflected XSS in INFINITT ULite login error page (pre-auth)

Published Nov 6, 2026

Updated

A reflected cross-site scripting (XSS) vulnerability in the login/SSO error page of INFINITT ULite 5.0.2.1BN4820260528 and earlier allows an unauthenticated remote attacker to execute arbitrary JavaScript in the browser of a victim who opens a crafted link. An unsanitized request parameter is reflected without output encoding. Fixed in ULite 5.0.2.1 BN50.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade INFINITT ULite to a version that resolves this vulnerability.
Fixed in 5.0.2.1 BN50
Configuration
As defense in depth, remove 'unsafe-inline' from the Content-Security-Policy script-src directive.
INFINITT ULite Content-Security-Policy script-src = remove 'unsafe-inline'

Event History

Nov 6, 2026

CVE Published

via MITRE·08:29 AM

Data Sourced

via MITRE·08:29 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users of INFINITT ULite 5.0.2.1_BN48_20260528 and earlier are exposed when they open a crafted link targeting the login or SSO error page. The attack occurs before authentication, so the attacker does not need an account.

What does an attacker need to exploit it?

An attacker needs to convince a victim to open a crafted link containing a malicious value in the reflected request parameter. The payload then executes arbitrary JavaScript in that victim's browser.

Which version fixes the vulnerability?

The issue is fixed in INFINITT ULite 5.0.2.1 BN50.

CVE-2026-19876: Reflected XSS in INFINITT ULite login error page (pre-auth)

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Which version fixes the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Which version fixes the vulnerability?