CVE-2026-66092

UNKNOWN 0.0

Stored XSS in pre-login notice via reachable legacy logon route

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDIT_SYSTEM_SETTINGS permission can set a notice containing an arbitrary script (PUT /api/preloginnotice), resulting in stored cross-site scripting on the login page. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or Everyone

CWE	CWE-79
Vendor	apereo foundation
Product	openequella
Published	Oct 29, 2026
Last Updated	Oct 29, 2026

Stay Ahead of the Next One

Get instant alerts for apereo foundation openequella

Be the first to know when new unknown vulnerabilities affecting apereo foundation openequella are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apereo Foundation / openEQUELLA

2019.1 < 2026.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/openequella/openEQUELLA/security/advisories/GHSA-9jhj-7h37-3j2c openequella.github.io: https://openequella.github.io/guides/

Credits

Nguyễn Tuấn Hùng ( University of Information Technology: VNUHCM - UIT ) Lê Ngọc Bảo Minh ( University of Information Technology: VNUHCM - UIT )