CVE-2026-11854
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The authentication endpoint generates an error message that reflects request data without sufficient sanitization or encoding, allowing an attacker to inject malicious scripts executed in the victim's browser (reflected XSS).
Risk Assessment
An attacker can perform actions in the user's browser such as redirecting to a malicious site, modifying the UI, or retrieving information; session hijacking is mitigated by the httpOnly flag on session cookies.
Recommendation
Apply the vendor fix for the authentication endpoint and ensure encoding/sanitization of data reflected in error messages. Consider deploying a Content-Security-Policy header.
Other vulnerabilities in Authentication endpoint
See all- CVE-2025-5769Medium
The authentication endpoint does not properly encode user-supplied input before rendering it within the web page. This lack of output encoding allows an attacker to inject malicious JavaScript payloads into the authentication flow, which are then executed by the victim's browser.
- CVE-2024-5139Medium
The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint.
- CVE-2025-10503Medium
The authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to lack of proper output encoding. This allows injection of malicious JavaScript payloads, enabling reflected cross-site scripting. An attacker can redirect the browser to a malicious website, modify the UI, or retrieve information, but session hijacking is not possible due to httpOnly flag on session cookies.
- CVE-2025-6024Medium
The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browser. However, session hijacking is not possible due to the httpOnly flag protecting session-related cookies.
Original NVD description (English source)
The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser. Successful exploitation enables an attacker to perform actions within the user's browser, such as redirecting the user to a malicious website, modifying the web page's user interface, or retrieving information. However, due to the httpOnly flag on session-related cookies, session hijacking or similar attacks are not possible.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS