CVE-2025-10503
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to lack of proper output encoding. This allows injection of malicious JavaScript payloads, enabling reflected cross-site scripting. An attacker can redirect the browser to a malicious website, modify the UI, or retrieve information, but session hijacking is not possible due to httpOnly flag on session cookies.
Risk Assessment
An attacker can exploit Reflected XSS to redirect users to malicious sites, modify the interface, or steal browser information, potentially leading to phishing or data exfiltration.
Recommendation
Implement proper input validation and output encoding in the authentication endpoint to prevent JavaScript injection.
Other vulnerabilities in Authentication endpoint
See all- CVE-2025-5769Medium
The authentication endpoint does not properly encode user-supplied input before rendering it within the web page. This lack of output encoding allows an attacker to inject malicious JavaScript payloads into the authentication flow, which are then executed by the victim's browser.
- CVE-2026-11854Medium
The authentication endpoint generates an error message that reflects request data without sufficient sanitization or encoding, allowing an attacker to inject malicious scripts executed in the victim's browser (reflected XSS).
- CVE-2024-5139Medium
The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint.
- CVE-2025-6024Medium
The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browser. However, session hijacking is not possible due to the httpOnly flag protecting session-related cookies.
Original NVD description (English source)
The authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to a lack of proper output encoding. This allows for the injection of malicious JavaScript payloads, enabling reflected cross-site scripting. An attacker can leverage this vulnerability to redirect the user's browser to a malicious website, modify the user interface of the web page, retrieve information from the browser, or cause other harmful actions. However, due to the protection of session-related cookies with the httpOnly flag, session hijacking is not possible.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS