CVE-2026-55730 is a reflected cross-site scripting vulnerability in Loytec LWEB-802 versions prior to 5.0.8. The flaw arises from improper neutralization of input during web page generation, specifically involving the 'project' or 'mspParams' parameters. An unauthenticated attacker can exploit this by sending a crafted link that executes arbitrary JavaScript in the context of the victim's browser, potentially allowing unauthorized actions with the victim's privileges. The vulnerability is publicly known and assigned a CVSS 4.0 score of 8.7, indicating high severity. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary JavaScript code in the victim's browser. This can lead to unauthorized actions performed with the victim's privileges, potentially compromising user data or session integrity. The vulnerability affects all platforms running vulnerable versions of Loytec LWEB-802 prior to 5.0.8. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking on untrusted links containing 'project' or 'mspParams' parameters. Network-level protections such as web application firewalls may help mitigate exploitation attempts, but no vendor-provided mitigation or temporary fix is currently documented.