CVE-2026-6493: Rallly Reset Password XSS Vulnerability

CVE-2026-6493 Overview

A Cross-Site Scripting (XSS) vulnerability has been identified in Rallly, an open-source scheduling and polling application developed by lukevella. The flaw exists in the Reset Password Handler component, specifically within the file apps/web/src/app/[locale]/(auth)/reset-password/components/reset-password-form.tsx. By manipulating the redirectTo argument, an attacker can inject malicious scripts that execute in the context of a victim's browser session.

This vulnerability affects Rallly versions up to 4.7.4 and can be exploited remotely. The exploit has been publicly disclosed, increasing the risk of active exploitation. Users are strongly advised to upgrade to version 4.8.0 or later to mitigate this security issue.

Critical Impact

Remote attackers can execute arbitrary JavaScript in victim browsers through the password reset functionality, potentially leading to session hijacking, credential theft, or phishing attacks.

Affected Products

• Rallly versions up to 4.7.4
• Password Reset Handler component (reset-password-form.tsx)
• Web application deployments with vulnerable versions

Discovery Timeline

• 2026-04-17 - CVE CVE-2026-6493 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-6493

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw resides in the password reset functionality where the redirectTo parameter is not properly sanitized before being used in the application's response.

When a user initiates a password reset, the application accepts a redirectTo parameter intended to redirect users after successful password reset. However, due to insufficient input validation, an attacker can craft a malicious URL containing JavaScript code in this parameter. When a victim clicks on the malicious link and completes the password reset process, the injected script executes in their browser context.

The vulnerability requires user interaction (the victim must click on a crafted link) and affects the integrity of the web application. Since the attack vector is network-based and requires low privileges, it presents a realistic attack scenario for phishing campaigns targeting Rallly users.

Root Cause

The root cause of this vulnerability is improper input validation and sanitization of the redirectTo parameter in the reset-password-form.tsx component. The application fails to properly encode or validate user-supplied input before incorporating it into the page output or redirect logic, allowing attackers to inject executable JavaScript code.

Attack Vector

The attack is executed remotely via the network. An attacker crafts a malicious URL containing a XSS payload in the redirectTo parameter and distributes it to potential victims through phishing emails, social engineering, or malicious websites. When an authenticated or authenticating user clicks the link and interacts with the password reset form, the malicious script executes in their browser.

The attacker can leverage this vulnerability to steal session cookies, capture user credentials, perform actions on behalf of the victim, or redirect users to malicious external sites.

The vulnerability can be exploited by manipulating the redirectTo parameter in the password reset URL. An attacker constructs a URL where this parameter contains JavaScript code instead of a legitimate redirect path. When the victim interacts with the password reset form, the application processes the unvalidated parameter, causing the malicious script to execute. Technical details and proof-of-concept code are available in the GitHub Gist PoC.

Detection Methods for CVE-2026-6493

Indicators of Compromise

• Suspicious URLs containing encoded JavaScript or HTML in the redirectTo parameter
• Unusual outbound connections from user browsers following password reset interactions
• Server logs showing password reset requests with abnormally long or encoded redirectTo values
• Reports of phishing emails directing users to Rallly password reset pages with suspicious parameters

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect XSS patterns in URL parameters
• Monitor application logs for password reset requests containing script tags, event handlers, or encoded payloads
• Deploy browser-based security controls to detect and block reflected XSS execution
• Utilize endpoint detection solutions to identify suspicious JavaScript execution originating from trusted application domains

Monitoring Recommendations

• Enable verbose logging for authentication and password reset workflows
• Configure alerts for URLs containing common XSS payload signatures in the redirectTo parameter
• Monitor Content Security Policy (CSP) violation reports for inline script execution attempts
• Review referrer headers in password reset requests for suspicious external sources

How to Mitigate CVE-2026-6493

Immediate Actions Required

• Upgrade Rallly to version 4.8.0 or later immediately
• Review server logs for any evidence of exploitation attempts
• Notify users about the vulnerability and advise caution with password reset emails
• Implement Content Security Policy (CSP) headers to mitigate XSS impact as a defense-in-depth measure

Patch Information

The vulnerability has been addressed in Rallly version 4.8.0. The fix is available through the official GitHub release. The remediation was implemented via Pull Request #2245, which adds proper input validation and sanitization for the redirectTo parameter.

Organizations running self-hosted Rallly instances should update to the patched version as soon as possible. For cloud-hosted instances, verify with the service provider that the update has been applied.

Workarounds

• Implement a Web Application Firewall (WAF) rule to filter or block requests containing suspicious patterns in the redirectTo parameter
• Configure Content Security Policy (CSP) headers to restrict inline script execution
• Disable the password reset functionality temporarily until the patch can be applied
• Educate users to verify password reset links and avoid clicking links from untrusted sources

# Example: Add CSP header to restrict inline scripts (Nginx configuration)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';" always;