CVE-2026-9357: vBulletin Login cross site scripting
A vulnerability was found in vBulletin 6.x. This impacts an unknown function of the component Login. Performing a manipulation results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. VulDB is withholding an extended redistribution of exploit details to prevent simplified exploitation. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the public Login component or otherwise restrict access to it (for example, remove public access or require access only from trusted IPs) until the vendor provides a security update.
vBulletin Login enabled = false or restricted - Compensating control
Deploy web application firewall (WAF) rules or other input-filtering at the edge to block common XSS payloads against the login endpoints, and restrict access to the login page to trusted IP ranges or internal networks where possible.
- Operational
Monitor web server and application logs for suspicious requests and exploitation attempts against the login functionality; invalidate active sessions and force password resets / rotate credentials for accounts that may have been exposed if any compromise is suspected.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9357?
The severity of CVE-2026-9357 is rated as low with a score of 3.5.
What type of vulnerability is associated with CVE-2026-9357?
CVE-2026-9357 is associated with cross-site scripting (XSS) vulnerabilities.
How can I mitigate CVE-2026-9357?
Mitigating CVE-2026-9357 involves ensuring that user inputs in the Login component of vBulletin are properly sanitized.
Is CVE-2026-9357 exploitable remotely?
Yes, CVE-2026-9357 can be exploited remotely due to the nature of the vulnerability.
What impact does CVE-2026-9357 have on the system?
CVE-2026-9357 results in the ability to perform cross-site scripting, which may allow attackers to inject malicious scripts.