CVE-2026-91922: Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render
Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaApi or data parameters to execute arbitrary JavaScript in victim sessions and steal X-Auth-Token credentials.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker does not need authentication to send a crafted link because the affected /api/page/render endpoint is anonymous. Exploitation requires persuading a victim to open that link.
What impact should be considered during triage?
Successful exploitation runs arbitrary JavaScript in the victim's session context. The reported impact includes theft of X-Auth-Token credentials, with confidentiality and integrity effects.
Which inputs are involved in the attack?
The malicious link uses script-terminating sequences in the schemaApi or data query parameters. These values are insufficiently escaped when rendered into inline script elements.
Are installations on the listed release range affected by default?
The available data identifies the anonymous endpoint as affected but does not state whether it is enabled or reachable in a default deployment. Verify whether /api/page/render is exposed to untrusted users or can be reached by victims through attacker-controlled links.