CVE-2025-6024
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browser. However, session hijacking is not possible due to the httpOnly flag protecting session-related cookies.
Risk Assessment
Users may be redirected to malicious sites or their browser data may be stolen, compromising trust and security.
Recommendation
Implement proper output encoding on the authentication endpoint. Update the software to a patched version.
Other vulnerabilities in Authentication endpoint
See all- CVE-2025-5769Medium
The authentication endpoint does not properly encode user-supplied input before rendering it within the web page. This lack of output encoding allows an attacker to inject malicious JavaScript payloads into the authentication flow, which are then executed by the victim's browser.
- CVE-2026-11854Medium
The authentication endpoint generates an error message that reflects request data without sufficient sanitization or encoding, allowing an attacker to inject malicious scripts executed in the victim's browser (reflected XSS).
- CVE-2024-5139Medium
The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint.
- CVE-2025-10503Medium
The authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to lack of proper output encoding. This allows injection of malicious JavaScript payloads, enabling reflected cross-site scripting. An attacker can redirect the browser to a malicious website, modify the UI, or retrieve information, but session hijacking is not possible due to httpOnly flag on session cookies.
Original NVD description (English source)
The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browser. However, session hijacking is not possible due to the httpOnly flag protecting session-related cookies.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS