CVE-2026-32250: NamelessMC Reflected XSS Vulnerability

CVE-2026-32250 Overview

CVE-2026-32250 is a reflected Cross-Site Scripting (XSS) vulnerability in NamelessMC, website software used by Minecraft server operators. The flaw affects version 2.2.4 and resides in the id parameter of the /index.php?route=/queries/user/ endpoint. The application reflects user-supplied input into the HTML response without proper sanitization or output encoding. Attackers can craft URLs containing JavaScript payloads that execute in a victim's browser when the link is visited. Successful exploitation enables session hijacking, phishing, and arbitrary content manipulation within the trusted site context. NamelessMC released version 2.2.5 to address the issue. This vulnerability is categorized under [CWE-79].

Critical Impact
Attackers can execute arbitrary JavaScript in the victim browser session, enabling cookie theft, account takeover via session hijacking, and credential phishing through manipulated page content.

Affected Products

NamelessMC version 2.2.4
Earlier NamelessMC releases sharing the vulnerable queries/user route handler
Fixed in NamelessMC version 2.2.5

Discovery Timeline

2026-06-02 - CVE-2026-32250 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-32250

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the NamelessMC user query endpoint. The id parameter received via HTTP GET is embedded directly in the server's HTML response. The application does not apply HTML entity encoding or contextual sanitization before reflecting the value to the page. An attacker crafts a URL of the form /index.php?route=/queries/user/&id=<payload> containing a JavaScript payload. When an authenticated user visits the malicious link, the browser parses and executes the injected script in the origin of the NamelessMC site. The script inherits the victim's session cookies, CSRF tokens, and DOM access for that origin. NamelessMC commonly runs on community gaming sites where moderators and administrators hold elevated privileges, increasing the impact of targeted social engineering. The EPSS score of 0.029% reflects low observed exploitation interest at publication, but reflected XSS payloads are trivial to construct and distribute through Discord, forums, and in-game chat.

Root Cause

The root cause is missing output encoding when rendering attacker-controlled query string data. The handler for /queries/user/ trusts the id value and concatenates it into HTML without using a templating escape function. This violates secure coding guidance requiring context-aware encoding for all reflected user input ([CWE-79]).

Attack Vector

Exploitation requires user interaction. An attacker hosts or distributes a crafted URL pointing at a vulnerable NamelessMC site. The victim must click the link while their browser is in a position to execute scripts on the target origin. No prior authentication or privileges are required on the attacker side. Authenticated victims expose their session, while unauthenticated victims can be redirected into phishing flows that mimic the legitimate NamelessMC login page. See the GitHub Security Advisory GHSA-343f-c4gf-rxc7 for the upstream technical write-up.

Detection Methods for CVE-2026-32250

Indicators of Compromise

Web server access logs containing requests to /index.php?route=/queries/user/ with id parameter values that include <script>, onerror=, onload=, javascript:, or URL-encoded equivalents such as %3Cscript%3E.
Referrer headers from external chat platforms, pastebin domains, or URL shorteners pointing to the /queries/user/ endpoint.
Unusual outbound requests from user browsers to attacker-controlled domains shortly after visiting NamelessMC links.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects the id query parameter for HTML and JavaScript metacharacters.
Add server-side logging that records the raw id parameter and alerts on payloads matching XSS signatures.
Review browser Content Security Policy (CSP) violation reports for inline script execution on the /queries/user/ route.

Monitoring Recommendations

Monitor administrator and moderator session activity for anomalous IP changes or token reuse that may indicate session hijacking.
Track failed and successful logins immediately following clicks on community-shared links to NamelessMC pages.
Aggregate web access logs into a SIEM and correlate XSS payload patterns with downstream account changes.

How to Mitigate CVE-2026-32250

Immediate Actions Required

Upgrade NamelessMC to version 2.2.5 or later, which contains the official fix for the reflected XSS in the id parameter.
Invalidate active administrator and moderator sessions after upgrading to neutralize any tokens that may have been captured.
Communicate the issue to community staff and warn users against clicking unverified /queries/user/ links until the upgrade is complete.

Patch Information

NamelessMC version 2.2.5 fixes the issue by applying proper output encoding to the id parameter on the /queries/user/ route. The fix is documented in the NamelessMC GitHub Security Advisory GHSA-343f-c4gf-rxc7. Site operators should apply the upgrade through the standard NamelessMC update process and verify the installed version in the admin panel.

Workarounds

Deploy a WAF rule that blocks requests to /index.php?route=/queries/user/ when the id parameter contains <, >, ", ', or known XSS keywords.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Restrict access to the /queries/user/ endpoint to authenticated administrators via reverse proxy rules until the patch is applied.

bash

# Example nginx rule to block XSS payloads on the vulnerable endpoint
location ~ ^/index\.php {
    if ($arg_route = "/queries/user/") {
        if ($arg_id ~* "(<|%3C|script|onerror|onload|javascript:)") {
            return 403;
        }
    }
}