CVE-2026-2971
Remote XSS in a466350665 Smart-SSO Login RedirectUri Parameter
Publication date: 2026-02-23
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| a466350665 | smart-sso | to 2.1.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-2971 is a reflected Cross-Site Scripting (XSS) vulnerability in the Smart-SSO product up to version 2.1.1. It occurs in the Login component, specifically in the file smart-sso-server/src/main/resources/templates/login.html. The vulnerability arises because the redirectUri parameter is user-controllable and not properly sanitized before being included in the web page output.'}, {'type': 'paragraph', 'content': "This flaw allows an attacker to inject malicious scripts that execute in the context of the victim's browser. The attack can be performed remotely without authentication but requires user interaction to trigger the exploit."}, {'type': 'paragraph', 'content': 'The vulnerability is classified under CWE-79 and is considered easy to exploit. A proof-of-concept exploit is publicly available.'}] [1, 2]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': "This vulnerability can allow attackers to execute arbitrary scripts in the victim's browser, which can lead to several malicious outcomes."}, {'type': 'list_item', 'content': 'Session hijacking, where attackers steal session tokens to impersonate users.'}, {'type': 'list_item', 'content': 'Credential theft by capturing user input or cookies.'}, {'type': 'list_item', 'content': 'Manipulation of the web application’s behavior or content as seen by the user.'}, {'type': 'paragraph', 'content': 'Because the attack requires user interaction, social engineering techniques might be used to trick users into triggering the exploit.'}] [1, 2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by identifying if the affected Smart-SSO login page is accessible and vulnerable to reflected XSS via the redirectUri parameter.'}, {'type': 'paragraph', 'content': 'One method is to use Google dorking to find URLs containing the vulnerable login page path.'}, {'type': 'list_item', 'content': 'Use a search query like: site:yourdomain.com inurl:"smart-sso-server/src/main/resources/templates/login.html"'}, {'type': 'paragraph', 'content': 'To test directly on your system, you can craft HTTP requests injecting a simple XSS payload into the redirectUri parameter and observe if it is reflected unescaped in the response.'}, {'type': 'list_item', 'content': 'Example curl command to test the vulnerability:'}, {'type': 'list_item', 'content': 'curl -i "http://your-smart-sso-domain/smart-sso-server/src/main/resources/templates/login.html?redirectUri=<script>alert(1)</script>"'}, {'type': 'paragraph', 'content': 'If the response contains the injected script tag without proper encoding or escaping, the system is vulnerable.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
No known mitigations or countermeasures have been published by the vendor for this vulnerability.
Immediate steps include avoiding use of the affected Smart-SSO versions up to 2.1.1 and replacing the product with an alternative solution if possible.
Additionally, you can implement web application firewall (WAF) rules to detect and block suspicious requests containing script injection attempts in the redirectUri parameter.
Educate users to be cautious about clicking on suspicious links that may exploit this reflected XSS vulnerability.