CVE-2026-45343 is a stored cross-site scripting vulnerability (CWE-79) in Kovah's LinkAce prior to version 2.5.6. The flaw exists in the handling of OAuth display names when creating API tokens, allowing a low-privilege user to inject malicious JavaScript into the audit log. This script executes in the context of an administrator's browser when they access the /system/audit page, enabling theft of session cookies and CSRF tokens. The vulnerability affects instances configured with SSO/OAuth authentication. The issue is resolved in LinkAce 2.5.6.

Successful exploitation allows an attacker with low privileges to execute arbitrary JavaScript in an administrator's browser session. This can lead to session cookie theft, CSRF token exfiltration, and potentially any action the administrator can perform within the application. The vulnerability compromises the confidentiality and integrity of the administrator's session and can lead to full administrative control of the affected LinkAce instance.

This vulnerability is fixed in LinkAce version 2.5.6. Users should upgrade to version 2.5.6 or later to remediate this issue. Since no official patch link or advisory is provided, verify the upgrade availability from the vendor's official sources. Until upgraded, restrict access to the audit log page to trusted administrators and monitor for suspicious activity related to OAuth display names and API token creation.