{"id":"CVE-2024-5139","kind":"vulnerability","aliases":["CVE-2024-5139"],"related":[],"title":"Authentication endpoint XSS lets attackers run scripts in browsers","description":"The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint.\n\nSuccessful exploitation allows an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract sensitive information from the browser. However, due to the `httpOnly` flag on session-related cookies, session hijacking is not possible.","summary":"The Authentication Endpoint does not encode user-supplied input, so crafted input can inject malicious JavaScript. An attacker can redirect the user's browser, alter the page interface, or read data from the browser, but the sources say session hijacking is blocked by httpOnly session cookies.","severity":"medium","cvss":6.1,"epss":0.00227,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-21T14:17:04+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:03:29+00:00","updated_at":"2026-10-25T04:03:29+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-25T04:03:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Authentication endpoint XSS lets attackers run scripts in browsers","impact":"medium","summary":"The Authentication Endpoint does not encode user-supplied input, so crafted input can inject malicious JavaScript. An attacker can redirect the user's browser, alter the page interface, or read data from the browser, but the sources say session hijacking is blocked by httpOnly session cookies.","category":"other","nicknames":[],"who_cares":[],"confidence":0.4,"needs_auth":"unknown","worst_case":"Injected scripts alter pages and read browser data; sessions protected","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2024-5139, then fill in how_to_check and fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000846,"input_tokens":3421,"output_tokens":1007,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2024':11A,14A '-5139':12A,15A 'accept':66C 'allow':74C,97C 'alter':41B 'attack':5A,34B,99C 'authent':1A,17B,64C,93C 'block':58B 'browser':9A,40B,50B,105C,123C 'cooki':62B,134C 'craft':27B,89C 'cve':10A,13A 'data':47B 'due':125C 'encod':21B,73C 'endpoint':2A,18B,65C,94C 'exploit':96C 'extract':118C 'flag':129C 'hijack':56B,136C 'howev':124C 'httpon':60B,128C 'inform':120C 'inject':30B,77C 'input':25B,28B,70C,90C 'interfac':44B,116C 'javascript':32B,80C 'let':4A 'malici':31B,79C,108C 'modifi':110C 'page':43B,113C 'payload':81C 'possibl':139C 'read':46B 'redirect':36B,101C 'relat':133C 'run':6A 'say':54B 'script':7A 'sensit':119C 'session':55B,61B,132C,135C 'session-rel':131C 'sourc':53B 'submit':88C 'success':95C 'suffici':72C 'suppli':24B,69C 'trigger':86C 'user':23B,38B,68C,103C,115C 'user-suppli':22B,67C 'vulner':83C 'web':112C 'websit':109C 'without':71C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T14:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"ed10eef1-636d-4fbe-9993-6890dfa878f8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2024-5139","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5139","severity":null,"published_at":"2026-10-21T14:17:04+00:00","modified_at":"2026-10-21T18:37:59+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2024-5139","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-5139","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}