{"id":"CVE-2026-5808","summary":"openstatusHQ openstatus Onboarding Endpoint client.tsx cross site scripting","details":"A vulnerability was detected in openstatusHQ openstatus up to 1b678e71a85961ae319cbb214a8eae634059330c. This impacts an unknown function of the file apps/dashboard/src/app/(dashboard)/onboarding/client.tsx of the component Onboarding Endpoint. The manipulation of the argument callbackURL results in cross site scripting. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The patch is identified as 43d9b2b9ef8ae1a98f9bdc8a9f86d6a3dfaa2dfb. It is advisable to implement a patch to correct this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.","modified":"2026-10-08T02:52:10.978110109Z","published":"2026-04-08T21:30:16.897Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5808.json","cna_assigner":"VulDB","cwe_ids":["CWE-79","CWE-94"]},"references":[{"type":"WEB","url":"https://gist.github.com/TrebledJ/ab83abb1ca7ff6c1f39e16a37020f323"},{"type":"WEB","url":"https://github.com/openstatusHQ/openstatus/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5808.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5808"},{"type":"ADVISORY","url":"https://vuldb.com/submit/787321"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/356245"},{"type":"REPORT","url":"https://vuldb.com/vuln/356245/cti"},{"type":"FIX","url":"https://github.com/openstatusHQ/openstatus/commit/43d9b2b9ef8ae1a98f9bdc8a9f86d6a3dfaa2dfb"},{"type":"FIX","url":"https://github.com/openstatusHQ/openstatus/pull/1981"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openstatushq/openstatus","events":[{"introduced":"1b678e71a85961ae319cbb214a8eae634059330c"},{"last_affected":"1b678e71a85961ae319cbb214a8eae634059330c"}]}],"versions":["1b678e71a85961ae319cbb214a8eae634059330c"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5808.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X"}]}