CVE-2024-5139

The authentication endpoint does not properly encode user-supplied input before rendering it within the web page. This lack of output encoding allows an attacker to inject malicious JavaScript payloads into the authentication flow, which are then executed by the victim's browser.

The authentication endpoint generates an error message that reflects request data without sufficient sanitization or encoding, allowing an attacker to inject malicious scripts executed in the victim's browser (reflected XSS).

The authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to lack of proper output encoding. This allows injection of malicious JavaScript payloads, enabling reflected cross-site scripting. An attacker can redirect the browser to a malicious website, modify the UI, or retrieve information, but session hijacking is not possible due to httpOnly flag on session cookies.

The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browser. However, session hijacking is not possible due to the httpOnly flag protecting session-related cookies.