CVE-2026-21730 is a stored XSS vulnerability in Verint Verba's login logging feature. When an attacker submits a crafted username during a failed login, the input is logged without proper sanitization. This allows malicious script injection that executes in the context of an administrator's browser when accessing the log viewer. The vulnerability affects versions prior to 10.0.6, where it has been fixed. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, user interaction required, and low scope and impact metrics.

An attacker can execute arbitrary scripts in the administrator's browser by injecting malicious payloads into the username field during failed login attempts. This could lead to session hijacking, unauthorized actions, or information disclosure within the admin interface. However, exploitation requires the administrator to view the logs containing the injected payload. The vulnerability is rated medium severity with a CVSS score of 5.3.

Upgrade Verint Verba to version 10.0.6 or later, where this vulnerability has been fixed. Since the vendor has released an official fix, applying this update is the recommended remediation. Until the upgrade is applied, restrict administrative access to the log viewer to trusted personnel only to reduce risk.