CVE-2026-50980: n/a

CVE-2026-50980 is a Cross-Site Scripting (XSS) vulnerability affecting the DNS lookup/management component of oPanel prior to version 1.20.25. An attacker can exploit this vulnerability by crafting a malicious DNS TXT record that, when processed by the vulnerable component, results in the execution of arbitrary JavaScript code. This can lead to session hijacking and other client-side impacts. The vulnerability is remotely exploitable without privileges and requires user interaction. No official patch or remediation information is currently available.

Successful exploitation allows remote attackers to execute arbitrary JavaScript in the context of the affected application, potentially leading to session hijacking. The vulnerability does not impact confidentiality beyond the session context, nor does it affect availability. The attack requires user interaction and can be performed remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when processing DNS TXT records in oPanel and consider applying any vendor-recommended temporary mitigations once published.