CVE-2025-40681: xCally Omnichannel XSS Vulnerability

CVE-2025-40681 Overview

CVE-2025-40681 is a reflected Cross-Site Scripting (XSS) vulnerability affecting xCally Omnichannel version 3.30.1. The flaw resides in the failureMessage parameter of the /login endpoint. An attacker can craft a malicious URL that, when visited by an authenticated victim, causes arbitrary JavaScript to execute in the browser context of the application. This vulnerability is categorized under [CWE-79] and can be leveraged to steal session cookies, exfiltrate sensitive data, or perform actions on behalf of the targeted user.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session hijacking and unauthorized actions within the xCally Omnichannel application.

Affected Products

xCally Omnichannel v3.30.1
Vendor: xCally
Vulnerable endpoint: /login (parameter: failureMessage)

Discovery Timeline

2025-11-13 - CVE-2025-40681 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-40681

Vulnerability Analysis

The vulnerability is a reflected Cross-Site Scripting (XSS) issue in the xCally Omnichannel web application. The /login endpoint accepts a failureMessage query parameter intended to display authentication error messages. The application reflects the parameter value directly into the HTML response without proper output encoding or input sanitization. This allows attacker-controlled content, including HTML and JavaScript, to be rendered in the victim's browser.

Because the payload executes within the origin of the xCally Omnichannel application, it inherits the security context of the authenticated user. Attackers can read the Document Object Model (DOM), access session tokens not marked HttpOnly, and issue authenticated requests against the application on behalf of the victim.

Root Cause

The root cause is improper neutralization of user-supplied input during web page generation [CWE-79]. The failureMessage parameter is echoed into the login page response without HTML entity encoding or context-aware escaping, allowing script content to break out of the intended data context and execute as code.

Attack Vector

Exploitation requires user interaction. An attacker crafts a URL pointing to the vulnerable /login endpoint with a malicious failureMessage value containing a JavaScript payload. The attacker then delivers this URL through phishing emails, chat messages, or malicious websites. When a victim clicks the link and the login page loads, the injected script executes in their browser. See the INCIBE Security Notice on XSS for additional technical context.

No authentication is required to craft the malicious URL, but successful exploitation depends on the victim interacting with the crafted link while browsing the vulnerable application.

Detection Methods for CVE-2025-40681

Indicators of Compromise

HTTP requests to /login containing suspicious characters in the failureMessage parameter such as <script>, javascript:, onerror=, or URL-encoded equivalents (%3Cscript%3E).
Referer headers pointing to external, untrusted domains delivering users to the xCally /login page with populated failureMessage values.
Anomalous outbound requests from user browsers to attacker-controlled domains shortly after visiting the login page.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the failureMessage query parameter for XSS payload patterns.
Review web server access logs for /login requests with unusually long or encoded failureMessage values.
Correlate phishing email telemetry with URL clicks that target the xCally Omnichannel login page.

Monitoring Recommendations

Monitor for session token misuse, including logins from unexpected geographies or user agents immediately following login page visits.
Track browser telemetry for unexpected script execution or Content Security Policy (CSP) violations on the xCally domain.
Alert on outbound POST requests from user endpoints to unfamiliar domains containing cookie or credential values.

How to Mitigate CVE-2025-40681

Immediate Actions Required

Contact xCally support to confirm availability of a patched version beyond 3.30.1 and apply it as soon as it is released.
Deploy WAF rules to filter or sanitize the failureMessage parameter on all requests to /login.
Educate users to avoid clicking untrusted links to the xCally Omnichannel login page.

Patch Information

As of the last NVD update on 2026-06-17, no vendor-published patch URL is listed in the CVE record. Administrators should consult the INCIBE Security Notice on XSS and contact xCally directly for remediation guidance and fixed release information.

Workarounds

Configure a strict Content Security Policy (CSP) header on the xCally Omnichannel application to block inline script execution.
Ensure session cookies are set with HttpOnly and Secure flags to limit exposure if XSS is exploited.
Restrict access to the xCally Omnichannel application to trusted networks or via VPN until a patch is applied.
Use browser isolation or URL rewriting at the email gateway to neutralize malicious query strings in inbound links.

bash

# Example nginx configuration to add a restrictive Content Security Policy
# and block requests containing common XSS patterns in failureMessage

add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;

location /login {
    if ($arg_failureMessage ~* "(<|%3C)script|javascript:|onerror=|onload=") {
        return 403;
    }
    proxy_pass http://xcally_backend;
}