Kanidm versions prior to 1.9.3 contain a stored HTML injection vulnerability in the WebAuthn passkey-registration challenge rendering. The vulnerability arises because the account's displayname is embedded as raw JSON inside an inline script tag without escaping HTML special characters, allowing an attacker to inject arbitrary HTML. This injection can lead to authenticated same-origin request forgery via htmx attributes, enabling privilege escalation for authenticated users with certain admin rights. The vulnerability is fixed in version 1.9.3.