CVE-2026-58491

Summary

The flaw allows an attacker to inject malicious JavaScript into the response, potentially leading to session hijacking and unauthorized actions. It also enables open redirects, which can be used to redirect users to malicious sites.

Exploitability

Exploitation is relatively straightforward once a victim clicks a crafted link. Precondition is that the victim must complete SSO authentication.

Blast radius

If exploited, the attacker can access session data and perform actions through user APIs, and potentially through administrator APIs if the victim is an admin.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.25.5 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.