Live › vulnerability › CVE-2024-5139
Go to dashboardThe Authentication Endpoint does not encode user-supplied input, so crafted input can inject malicious JavaScript. An attacker can redirect the user's browser, alter the page interface, or read data from the browser, but the sources say session hijacking is blocked by httpOnly session cookies.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint.
Successful exploitation allows an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract sensitive information from the browser. However, due to the httpOnly flag on session-related cookies, session hijacking is not possible.
This page as .md · .json · in your agent: get_signal("CVE-2024-5139")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.