CVE-2026-90443 is a cross-site scripting (XSS) vulnerability in a web interface that reflects part of the request URL into a script context and a hyperlink attribute without proper encoding. The vulnerable interface does not require authentication, allowing unauthenticated attackers to craft malicious links. When a user visits such a link, arbitrary scripts can execute in the context of the affected application and redirect the user's browser to external sites. This can lead to actions performed with the user's session privileges within the application.