CVE-2026-44961: XML-RPC API Auth Bypass Vulnerability

CVE-2026-44961 Overview

CVE-2026-44961 is a validation bypass in the XML-RPC API addUser method. The flaw was introduced as a regression in the fix for CVE-2025-55129. Authenticated API users can create usernames that enable impersonation or persist stored cross-site scripting (XSS) payloads. The root weakness is classified as [CWE-287] Improper Authentication. Proper input validation has since been added to the affected method to remediate the issue.

Critical Impact
API clients able to invoke addUser can register crafted usernames that impersonate other accounts or inject stored XSS payloads rendered in administrative contexts.

Affected Products

Application exposing the XML-RPC API addUser method (vendor not specified in NVD record)
Versions containing the original fix for CVE-2025-55129
See the linked HackerOne report for product-specific version details

Discovery Timeline

2026-06-23 - CVE-2026-44961 published to the National Vulnerability Database (NVD)
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-44961

Vulnerability Analysis

The vulnerability resides in the XML-RPC API endpoint that exposes the addUser method. The fix for the prior issue, CVE-2025-55129, introduced validation logic intended to restrict username content. That validation path missed one or more input branches, allowing crafted usernames to pass through unchecked. Once stored, those usernames are rendered in user-facing interfaces and treated as legitimate account identifiers by downstream logic.

Two abuse outcomes follow from the missing validation. First, an attacker can register a username that visually or programmatically matches an existing account, enabling impersonation in audit logs, comment streams, or administrative views. Second, an attacker can embed HTML or JavaScript inside the username field, producing a stored XSS payload that executes when an administrator views user listings.

Root Cause

The root cause is incomplete input validation in the patched addUser handler. The validation routine added during the CVE-2025-55129 remediation did not cover the XML-RPC code path, leaving the API entry point unprotected while the equivalent web form path was correctly hardened.

Attack Vector

The attack vector is network-based via the XML-RPC interface. An attacker submits an addUser XML-RPC request containing a crafted username string. No user interaction is required beyond an administrator later viewing the resulting account in a browser context, at which point any embedded XSS payload executes.

No verified proof-of-concept code is published in the NVD record. Refer to the HackerOne Security Report #3680090 for technical specifics.

Detection Methods for CVE-2026-44961

Indicators of Compromise

User accounts with names containing HTML tags, angle brackets, quotation marks, or script keywords
Usernames that duplicate or visually mimic existing administrative accounts using whitespace or Unicode look-alikes
XML-RPC request logs containing addUser method calls from unexpected source addresses
Browser console errors or unexpected script execution on administrative user-listing pages

Detection Strategies

Audit the user database for accounts whose usernames contain non-alphanumeric characters outside the documented allowlist
Replay stored usernames through the post-patch validator and flag any that now fail validation
Correlate XML-RPC addUser calls with subsequent authentication or content-creation activity from the new account

Monitoring Recommendations

Enable verbose logging on the XML-RPC endpoint and forward logs to a central analytics platform
Alert on bursts of addUser invocations from a single client or unauthenticated source
Monitor administrative page loads for content security policy (CSP) violations indicative of stored XSS execution

How to Mitigate CVE-2026-44961

Immediate Actions Required

Apply the vendor update that adds the missing validation to the XML-RPC addUser handler
Review all accounts created since the CVE-2025-55129 patch and remove or rename entries with invalid characters
Rotate session tokens for administrative users who may have viewed a malicious username in their browser

Patch Information

The upstream fix adds the validation that was missing from the original CVE-2025-55129 remediation. Consult the HackerOne Security Report #3680090 for the patched version identifier and the corresponding code change.

Workarounds

Disable the XML-RPC API entirely if it is not required by integrations
Restrict network access to the XML-RPC endpoint using firewall or reverse-proxy allowlists
Enforce a strict CSP on administrative pages to limit the impact of stored XSS until the patch is applied

bash

# Example: block XML-RPC at the reverse proxy until patched
# nginx configuration snippet
location = /xmlrpc.php {
    deny all;
    return 403;
}