---
id: "CVE-2024-5139"
kind: "vulnerability"
aliases: ["CVE-2024-5139"]
title: "Authentication endpoint XSS lets attackers run scripts in browsers"
severity: "medium"
cvss: 6.1
epss: 0.00227
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other"]
not_affected_if: []
published_at: "2026-10-21T14:17:04+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T04:03:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5139", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-5139", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Authentication endpoint XSS lets attackers run scripts in browsers

The Authentication Endpoint does not encode user-supplied input, so crafted input can inject malicious JavaScript. An attacker can redirect the user's browser, alter the page interface, or read data from the browser, but the sources say session hijacking is blocked by httpOnly session cookies.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-5139
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2024-5139

## From the sources

The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint.

Successful exploitation allows an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract sensitive information from the browser. However, due to the `httpOnly` flag on session-related cookies, session hijacking is not possible.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_