Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute… (CVE-2026-50980)

The DNS lookup/management component of oPanel prior to version 1.20.25 is vulnerable to Cross-Site Scripting (CWE-79). An attacker can exploit this by submitting a specially crafted DNS TXT record that, when processed by the vulnerable component, results in the execution of arbitrary JavaScript code in the context of the victim's browser. This can lead to session hijacking and other client-side impacts. The vulnerability is identified as CVE-2026-50980 with a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). There is no information on known exploits in the wild or vendor-provided patches.

Successful exploitation allows remote attackers to execute arbitrary JavaScript in the context of affected users, potentially leading to session hijacking and partial confidentiality and integrity loss. The vulnerability does not impact availability. The attack requires user interaction (UI:R) and can affect confidentiality and integrity on a system-wide scope (S:C).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when handling DNS TXT records in oPanel and consider limiting exposure of the DNS management interface to trusted users only.