CVE-2026-53473CWE-79

Migration-planner-ui-app: stored xss via javascript: url in agent credential link

High · published June 10, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
26.7
In the wild
Unconfirmed
What it is

A flaw was found in migration-planner-ui-app. An attacker can register a malicious discovery agent with a specially crafted credentialUrl containing JavaScript code. When an organizational user clicks this link in the user interface, the embedded malicious code executes within the user's browser session. This cross-site scripting (XSS) vulnerability allows the attacker to compromise the victim's Red Hat Single Sign-On (SSO) session, potentially leading to unauthorized cross-tenant data access and API actions.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00344 · 26.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-06-10T13:55Z
EPSS history
Timeline
  • 10 JUN 13:55Z
    Migration-planner-ui-app: stored xss via javascript: url in agent credential link
    cvelistv5