CVE-2026-5808: Cross Site Scripting in openstatusHQ openstatus
CVE-2026-5808 is a cross-site scripting (XSS) vulnerability in openstatusHQ openstatus affecting the Onboarding Endpoint component. The issue arises from improper handling of the callbackURL argument in the file apps/dashboard/src/app/(dashboard)/onboarding/client. tsx, allowing remote attackers to inject malicious scripts. The product uses a rolling release model, so specific version numbers are not fixed, but a patch identified by commit 43d9b2b9ef8ae1a98f9bdc8a9f86d6a3dfaa2dfb has been released by the vendor. The vendor responded promptly and professionally to the report and issued a fix quickly. The vulnerability has a medium severity with a CVSS 4. 0 base score of 5. 3. No known exploits are reported in the wild at this time.
AI Analysis
Technical Summary
This vulnerability in openstatusHQ openstatus up to commit 1b678e71a85961ae319cbb214a8eae634059330c allows remote attackers to perform cross-site scripting by manipulating the callbackURL parameter in the Onboarding Endpoint component (apps/dashboard/src/app/(dashboard)/onboarding/client.tsx). The product is delivered via a rolling release process, and the vendor has released a patch identified by commit 43d9b2b9ef8ae1a98f9bdc8a9f86d6a3dfaa2dfb to address this issue. The vendor's quick and professional response indicates that the vulnerability is now fixed in the updated codebase.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, information disclosure, or other client-side attacks. However, the impact is limited to the scope of the XSS vulnerability and does not involve privilege escalation or server compromise. No known active exploitation has been reported.
Mitigation Recommendations
A patch fixing this vulnerability has been released by the vendor as identified by commit 43d9b2b9ef8ae1a98f9bdc8a9f86d6a3dfaa2dfb. Users of openstatusHQ openstatus should update to the latest rolling release that includes this patch to remediate the issue. Since the product uses a rolling release model, ensure that the deployment is updated accordingly. No additional mitigation steps are specified by the vendor.
CVE-2026-5808: Cross Site Scripting in openstatusHQ openstatus
Description
CVE-2026-5808 is a cross-site scripting (XSS) vulnerability in openstatusHQ openstatus affecting the Onboarding Endpoint component. The issue arises from improper handling of the callbackURL argument in the file apps/dashboard/src/app/(dashboard)/onboarding/client. tsx, allowing remote attackers to inject malicious scripts. The product uses a rolling release model, so specific version numbers are not fixed, but a patch identified by commit 43d9b2b9ef8ae1a98f9bdc8a9f86d6a3dfaa2dfb has been released by the vendor. The vendor responded promptly and professionally to the report and issued a fix quickly. The vulnerability has a medium severity with a CVSS 4. 0 base score of 5. 3. No known exploits are reported in the wild at this time.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in openstatusHQ openstatus up to commit 1b678e71a85961ae319cbb214a8eae634059330c allows remote attackers to perform cross-site scripting by manipulating the callbackURL parameter in the Onboarding Endpoint component (apps/dashboard/src/app/(dashboard)/onboarding/client.tsx). The product is delivered via a rolling release process, and the vendor has released a patch identified by commit 43d9b2b9ef8ae1a98f9bdc8a9f86d6a3dfaa2dfb to address this issue. The vendor's quick and professional response indicates that the vulnerability is now fixed in the updated codebase.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, information disclosure, or other client-side attacks. However, the impact is limited to the scope of the XSS vulnerability and does not involve privilege escalation or server compromise. No known active exploitation has been reported.
Mitigation Recommendations
A patch fixing this vulnerability has been released by the vendor as identified by commit 43d9b2b9ef8ae1a98f9bdc8a9f86d6a3dfaa2dfb. Users of openstatusHQ openstatus should update to the latest rolling release that includes this patch to remediate the issue. Since the product uses a rolling release model, ensure that the deployment is updated accordingly. No additional mitigation steps are specified by the vendor.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-04-08T14:56:12.185Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d6cdb91cc7ad14dab5bfbf
Added to database: 4/8/2026, 9:50:49 PM
Last enriched: 4/16/2026, 12:18:21 PM
Last updated: 5/23/2026, 4:21:09 PM
Views: 74
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.