CVE-2026-7190 is a cross-site scripting (XSS) vulnerability in the ICTBroadcast software demo environment. It occurs in the 'login.php' endpoint where the 'editForm[extension_username]' parameter is reflected without proper filtering. This flaw could allow attackers to execute arbitrary JavaScript in a victim's browser if the victim visits a crafted URL. The vulnerability has a medium severity rating with a CVSS score of 5.1. No affected versions or patches are currently specified.