CVE-2026-45343 is a stored cross-site scripting vulnerability in Kovah's LinkAce before version 2.5.6. It arises from improper neutralization of input during web page generation (CWE-79). Specifically, an attacker with low privileges can set their OAuth display name to a malicious script and create an API token, which stores the payload in the audit log. When an administrator accesses the /system/audit page, the malicious script executes in their browser context, enabling theft of session cookies, CSRF tokens, or other actions available to the admin. The vulnerability affects instances configured with SSO/OAuth authentication and is addressed in LinkAce 2.5.6.

Successful exploitation allows a low-privilege user to execute arbitrary JavaScript in an administrator's browser session. This can lead to session cookie theft and CSRF token exfiltration, potentially enabling unauthorized actions with administrator privileges. The vulnerability compromises the confidentiality and integrity of the administrator's session.

This vulnerability is fixed in LinkAce version 2.5.6. Users should upgrade to version 2.5.6 or later to remediate this issue. Since this is a self-hosted product, administrators must apply the update manually. Patch status is not explicitly stated in the vendor advisory, but the description confirms the fix is included in 2.5.6.