CVE-2025-68851 is an unauthenticated cross-site scripting (XSS) vulnerability in Okay Toolkit versions up to 2.3. The issue arises from improper neutralization of input during web page generation, classified under CWE-79. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, and requiring user interaction. The impact scope is changed (S:C), affecting confidentiality, integrity, and availability at a low level. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary scripts in the context of the affected application, potentially leading to partial disclosure of sensitive information, modification of data, and disruption of service. The CVSS vector indicates low confidentiality, integrity, and availability impacts, but the scope change suggests the vulnerability affects components beyond the initially vulnerable code.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or vendor advisory is available, users should monitor for updates from ArrayHQ and apply patches once released. In the meantime, consider implementing web application firewalls or input validation controls as temporary mitigations.