CVE-2026-2971: Smart-SSO Cross Site Scripting Vulnerability

CVE-2026-2971 Overview

CVE-2026-2971 is a reflected cross-site scripting (XSS) vulnerability affecting a466350665 Smart-SSO through version 2.1.1. The flaw resides in the Login component, specifically in smart-sso-server/src/main/resources/templates/login.html, where the redirectUri parameter is rendered without proper sanitization. Attackers can manipulate the parameter to inject script content that executes in the victim's browser. The exploit details are public, and the vendor did not respond to disclosure attempts. Because Smart-SSO functions as a single sign-on component, successful exploitation against authenticating users can expose session material or facilitate phishing flows targeting authenticated portals [CWE-79].

Critical Impact
Remote attackers can craft malicious login URLs that execute arbitrary JavaScript in the victim's browser session, with the vendor unresponsive to disclosure and no patch available.

Affected Products

a466350665 Smart-SSO versions up to and including 2.1.1
Smart-SSO server component (smart-sso-server)
Login template smart-sso-server/src/main/resources/templates/login.html

Discovery Timeline

2026-02-23 - CVE-2026-2971 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-2971

Vulnerability Analysis

The vulnerability is a reflected XSS issue in the Smart-SSO login flow. The login template directly reflects the value of the redirectUri query parameter back into rendered HTML output without applying contextual output encoding. When a user follows a crafted login URL, attacker-controlled markup is interpreted by the browser instead of being treated as data. Because Smart-SSO is a single sign-on entry point, scripts executing in this context can interact with authentication forms, capture credentials, or initiate redirects to attacker-controlled endpoints. User interaction is required, since the victim must click or follow the crafted link.

Root Cause

The root cause is missing or insufficient output encoding of user-supplied input in a server-rendered template. The redirectUri value is passed through to login.html and rendered without HTML, attribute, or JavaScript context escaping. This violates the standard mitigation guidance for [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Attack Vector

An attacker constructs a URL pointing at the Smart-SSO login endpoint with a malicious payload supplied via the redirectUri parameter. The victim is induced to click the URL through phishing, instant messaging, or a malicious referrer. When the login page loads, the injected payload executes within the origin of the Smart-SSO server. The attacker can then read DOM contents tied to the login flow, hook form submissions, or perform CSRF actions against authenticated endpoints. The exploit is remote, requires no privileges, and requires user interaction. Technical analysis is referenced in the Notion Analysis on Reflected XSS and the VulDB CTI Report #347338.

Detection Methods for CVE-2026-2971

Indicators of Compromise

HTTP requests to the Smart-SSO login endpoint containing redirectUri values with HTML tags, javascript: URIs, or event handler attributes such as onerror= and onload=.
URL-encoded payloads in redirectUri decoding to <script>, <img, <svg, or similar tag sequences.
Anomalous outbound requests from user browsers to unfamiliar domains shortly after visits to the Smart-SSO login page.

Detection Strategies

Inspect web server and reverse proxy access logs for redirectUri parameter values containing angle brackets, quotes, or script-related keywords.
Deploy web application firewall (WAF) rules that flag XSS signatures on query parameters targeting /login paths on Smart-SSO hosts.
Correlate referrer headers and login page hits with subsequent unusual JavaScript activity in browser telemetry.

Monitoring Recommendations

Enable verbose logging of full query strings for the Smart-SSO login endpoint and forward logs to a centralized analytics platform.
Alert on repeated requests sharing the same crafted redirectUri value across multiple user sessions, indicating a phishing campaign.
Monitor authentication audit trails for unexpected post-login redirects to off-domain hosts.

How to Mitigate CVE-2026-2971

Immediate Actions Required

Restrict access to the Smart-SSO login endpoint behind a WAF with rules that block script tags, event handlers, and javascript: URIs in the redirectUri parameter.
Implement an allowlist of permitted redirectUri values at the reverse proxy layer, rejecting any request containing values outside trusted application URLs.
Train users and helpdesk staff to scrutinize login URLs and report suspicious links impersonating internal SSO portals.

Patch Information

No vendor patch is available. The disclosure record notes that the vendor was contacted but did not respond. Organizations using a466350665 Smart-SSO should track the upstream repository for community fixes or consider migrating to a maintained SSO solution. Refer to the VulDB advisory #347338 for ongoing status.

Workarounds

Apply server-side validation that ensures redirectUri matches a strict allowlist of internal URLs before rendering the login page.
Add a strong Content Security Policy (CSP) header on the Smart-SSO server prohibiting inline scripts and restricting script sources to trusted origins.
Modify login.html to apply contextual output encoding (HTML attribute and JavaScript escaping) on any reflected redirectUri value.
Set the HttpOnly and SameSite=Strict attributes on session cookies to reduce the impact of script execution against authenticated sessions.

bash

# Example nginx configuration to block obvious XSS payloads in redirectUri
location /login {
    if ($arg_redirectUri ~* "(<|>|script|javascript:|onerror=|onload=)") {
        return 400;
    }
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'";
    add_header X-Content-Type-Options "nosniff";
    proxy_pass http://smart_sso_backend;
}