CVE-2026-50980

Deferred Deferred - Pending Action

Cross-Site Scripting in oPanel DNS Management

Publication date: 2026-08-28

Last updated on: 2026-09-09

Assigner: MITRE

Description

Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-09

Generated

2026-09-18

AI Q&A

2026-08-29

EPSS Evaluated

2026-09-15

NVD

CVE-2026-50980

EUVD

EUVD-2026-67917

Affected Vendors & Products

Vendor	Product	Version / Range
opanel	opanel	to 1.20.25 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-50980 is a stored Cross-Site Scripting (XSS) vulnerability in oPanel versions before v1.20.25. It occurs when oPanel queries an attacker-controlled nameserver for DNS records like TXT records and reflects raw responses without proper HTML sanitization. This allows malicious JavaScript to execute in a user's browser session when viewing the affected page.

Detection Guidance

To detect this vulnerability, monitor DNS TXT record responses for oPanel versions prior to v1.20.25. Check if raw DNS responses are reflected without sanitization in the web interface. Inspect network traffic for unexpected JavaScript payloads in TXT records. Use tools like dig or nslookup to query DNS records and analyze responses for malicious scripts.

Impact Analysis

This vulnerability can lead to session hijacking, theft of sensitive data such as authentication cookies, and unauthorized administrative access to oPanel. An attacker can set up a malicious DNS server to deliver a JavaScript payload that exfiltrates cookies to an attacker-controlled server with minimal user interaction required.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to sensitive data, such as authentication cookies or session tokens, which may contain personal or protected health information. Under GDPR, this could result in unauthorized data processing or breaches, requiring notification to authorities and affected individuals. For HIPAA, such an exploit could compromise protected health information (PHI), leading to violations of security rules and potential penalties.

Mitigation Strategies

Immediately upgrade oPanel to v1.20.25 or later. Implement strict input validation and output encoding for DNS responses. Disable or restrict access to the vulnerable DNS lookup/management component if not required. Monitor for unauthorized administrative access or suspicious activity.

Hi! I’m here to help you understand CVE-2026-50980. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70