CVE-2026-44960: Stored XSS via Username Vulnerability

CVE-2026-44960 Overview

CVE-2026-44960 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] triggered through the username field. An attacker can register or modify an account using a username containing a malicious JavaScript payload. When an administrator later opens the audit log details view, the payload renders in the admin browser because the application omits output sanitisation on that view. The flaw was reported through HackerOne and resolved by adding proper escaping to the audit log details output.

Critical Impact
Stored JavaScript executes in the context of an authenticated administrator session, enabling session theft, privileged actions, and pivoting against the management interface.

Affected Products

Specific affected products are not enumerated in the NVD record for CVE-2026-44960.
Refer to the HackerOne Report #3680090 for vendor-specific scope.
Administrators of any application consuming audit log entries should validate whether their build includes the escaping fix.

Discovery Timeline

2026-06-23 - CVE-2026-44960 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-44960

Vulnerability Analysis

The vulnerability is a stored XSS in the audit logging subsystem. User-controlled data, specifically the username value, is persisted alongside other audit metadata. When an administrator opens the audit log details view, the application renders the stored username into the HTML response without applying output encoding. Any HTML or JavaScript embedded in that username executes inside the administrator's authenticated browser session.

Because the payload is stored once and triggered on each subsequent view, a single low-privilege account creation can compromise every administrator who later inspects the corresponding log entry. The HackerOne disclosure indicates the fix consists of applying proper escaping to the audit log details output rather than restricting input.

Root Cause

The root cause is missing output sanitisation [CWE-79]. The audit log details renderer treated the stored username field as safe HTML rather than as untrusted text. No contextual escaping was applied before injection into the Document Object Model (DOM), allowing <script> tags and event-handler attributes to execute.

Attack Vector

The attack vector is network-based and requires no authentication on the application surface that accepts the malicious username. The attacker stores a crafted username such as one containing inline JavaScript via a <script> tag or an event handler attribute. The payload sits dormant in the audit log until an administrator opens the affected entry, at which point it executes with the administrator's privileges.

No verified proof-of-concept code is published in the NVD record. See the HackerOne Report #3680090 for disclosure context.

Detection Methods for CVE-2026-44960

Indicators of Compromise

Usernames in identity stores or audit tables containing <, >, script, onerror, onload, or javascript: substrings.
Audit log entries whose username field length is anomalously large compared to organizational naming conventions.
Administrator browser sessions issuing unexpected API calls immediately after viewing audit log details.

Detection Strategies

Query identity and audit data stores for username values matching HTML or JavaScript syntax patterns.
Inspect Content Security Policy (CSP) violation reports for inline script execution originating from administrative audit pages.
Correlate administrator session activity with audit log view events to surface anomalous post-view requests.

Monitoring Recommendations

Alert on creation or modification of accounts where the username contains non-alphanumeric structural characters.
Monitor administrative web sessions for unexpected outbound requests, token exfiltration, or privilege changes after audit log access.
Track repeated administrator views of the same suspicious audit log entry, which may indicate trigger reconnaissance.

How to Mitigate CVE-2026-44960

Immediate Actions Required

Apply the vendor release that introduces escaping in the audit log details output.
Audit existing usernames across the identity store and quarantine accounts containing markup or script syntax.
Restrict administrative access to the audit log interface to trusted networks and hardened workstations until patching completes.

Patch Information

The upstream fix adds proper escaping to the audit log details output so stored usernames are rendered as text rather than HTML. Consult the HackerOne Report #3680090 for the authoritative remediation reference and confirm your deployed build includes the escaping change.

Workarounds

Enforce a strict username validation policy that rejects characters outside an allow-list such as [A-Za-z0-9._-].
Deploy a Content Security Policy that disallows inline script execution on administrative pages to blunt payload execution.
Sanitize historical username records before they can be re-rendered in audit views.

bash

# Configuration example
# Example restrictive CSP header for the admin console
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'";