CVE-2026-90443 describes a reflected cross-site scripting (XSS) vulnerability where a web interface reflects a portion of the request URL into both a script context and a hyperlink attribute without adequate encoding. The interface is accessible without authentication, enabling unauthenticated network attackers to craft malicious links that execute arbitrary scripts in the victim's browser context and redirect users to external sites. This can lead to session hijacking or actions performed with the victim's privileges within the application.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected application and redirect users to arbitrary external sites. This can result in session hijacking or unauthorized actions performed with the compromised user's session privileges. The vulnerability is exploitable without authentication, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users and administrators should be cautious about clicking untrusted links that target the affected application. Implementing proper input validation and output encoding on the affected web interface is recommended once a patch or official guidance is provided.