CVE-2026-86244: FastAdmin User Controller XSS Vulnerability

CVE-2026-86244 Overview

CVE-2026-86244 is a cross-site scripting (XSS) vulnerability affecting FastAdmin up to version 1.2.0.20210401_beta. The flaw resides in the register/login functions of application/index/controller/User.php within the User Controller component. Attackers can manipulate the url argument to inject arbitrary script content that renders in a victim's browser. The vulnerability is exploitable remotely and requires user interaction to trigger. Public disclosure of the exploit has occurred, increasing the likelihood of opportunistic attacks against unpatched deployments. FastAdmin version 1.2.1.20210731_beta addresses the issue through the patch identified as commit b3d32e2bf3637488cfe2fc58a27a9d2475b2b51b.

Critical Impact
Remote attackers can inject malicious JavaScript through the url parameter in FastAdmin login and registration flows, enabling session theft, credential harvesting, and phishing against authenticated users [CWE-79].

Affected Products

FastAdmin versions up to and including 1.2.0.20210401_beta
Component: User Controller (application/index/controller/User.php)
Affected templates: application/common/view/tpl/dispatch_jump.tpl and application/index/view/user/login.html

Discovery Timeline

2026-09-07 - CVE-2026-86244 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86244

Vulnerability Analysis

The vulnerability stems from unsanitized output of the url parameter within FastAdmin's authentication views. When users interact with the register or login endpoints, the application accepts a url value intended as a post-authentication redirect target. This value is rendered directly into HTML templates without HTML entity encoding. An attacker who crafts a malicious link containing script payloads in the url parameter can execute arbitrary JavaScript in the victim's browser context once the page renders. The issue is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

The EPSS score sits at 0.273% with a percentile of 19.5, reflecting a relatively low but non-zero probability of near-term exploitation activity.

Root Cause

The root cause is missing output encoding in Blade-style template variables. Both the redirect anchor in dispatch_jump.tpl and the hidden form input in login.html emitted {$url} directly, allowing HTML and JavaScript syntax to pass through into the rendered DOM. Without an encoding filter such as htmlentities, template-level trust is placed on user-supplied query parameters.

Attack Vector

Exploitation requires an attacker to deliver a crafted URL to a victim, typically through phishing or a malicious link. The victim's browser then loads the FastAdmin login or register page with the tainted url value, and the injected payload executes in the origin of the FastAdmin instance. This enables session cookie theft, credential harvesting through fake form overlays, and defacement of authentication views.

text

// Patch: application/common/view/tpl/dispatch_jump.tpl
     <p class="clearfix">
         <a href="__PUBLIC__" class="btn btn-grey">{:__('Go back')}</a>
         {if $url}
-            <a href="{$url}" class="btn btn-primary">{:__('Jump now')}</a>
+            <a href="{$url|htmlentities}" class="btn btn-primary">{:__('Jump now')}</a>
         {/if}
     </p>
 </div>

Source: FastAdmin Commit b3d32e2

text

// Patch: application/index/view/user/login.html
         <div class="logon-tab clearfix"><a class="active">{:__('Sign in')}</a> <a href="{:url('user/register')}?url={$url|urlencode}">{:__('Sign up')}</a></div>
         <div class="login-main">
             <form name="form" id="login-form" class="form-vertical" method="POST" action="">
-                <input type="hidden" name="url" value="{$url}"/>
+                <input type="hidden" name="url" value="{$url|htmlentities}"/>
                 {:token()}

Source: FastAdmin Commit b3d32e2

The fix applies the htmlentities filter to convert reserved HTML characters into their entity equivalents, neutralizing script injection.

Detection Methods for CVE-2026-86244

Indicators of Compromise

Web server access logs showing requests to /index/user/login or /index/user/register with url parameters containing HTML characters such as <, >, ", script, or javascript:.
Referer headers pointing to external domains for authentication endpoints, suggesting phishing-driven traffic.
Outbound requests from user browsers to unknown domains following visits to the FastAdmin login page.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the url query parameter on FastAdmin authentication routes for XSS payload signatures.
Review HTTP request logs for URL-encoded script tags, event handler attributes (onerror=, onload=), and javascript: schemes targeting login endpoints.
Implement Content Security Policy (CSP) headers and monitor CSP violation reports for inline script execution attempts on authentication pages.

Monitoring Recommendations

Alert on repeated 200 responses from /index/user/login and /index/user/register containing suspicious url parameter values.
Monitor session cookie exfiltration attempts by tracking anomalous outbound HTTP requests originating from authenticated user sessions.
Track FastAdmin version banners across the estate to identify instances still running 1.2.0.20210401_beta or earlier.

How to Mitigate CVE-2026-86244

Immediate Actions Required

Upgrade FastAdmin to version 1.2.1.20210731_beta or later, which incorporates commit b3d32e2bf3637488cfe2fc58a27a9d2475b2b51b.
Audit all custom templates that render the url parameter and apply the htmlentities filter to any user-controlled output.
Deploy a strict Content Security Policy on FastAdmin frontends to limit script execution sources.

Patch Information

The vendor patch is available in the FastAdmin GitHub repository. The commit applies the htmlentities template filter to the url variable in both application/common/view/tpl/dispatch_jump.tpl and application/index/view/user/login.html. Administrators unable to upgrade immediately should backport this two-line change to their deployment. Additional context is available in the VulDB entry for CVE-2026-86244.

Workarounds

Apply the upstream template changes manually by adding the |htmlentities filter to every {$url} occurrence in FastAdmin views.
Configure reverse proxy rules to strip or reject url query parameters containing HTML metacharacters before requests reach the application.
Restrict login and register endpoints behind SSO or a network-level access control until patching is complete.

bash

# Nginx workaround: block XSS payloads in the url parameter on FastAdmin auth endpoints
location ~ ^/index/user/(login|register) {
    if ($arg_url ~* "(<|>|script|javascript:|onerror=|onload=)") {
        return 403;
    }
    proxy_pass http://fastadmin_backend;
}