CVE-2026-91922 Overview
CVE-2026-91922 is a reflected cross-site scripting (XSS) vulnerability in the Steedos Platform through version 3.0.15-beta.47. The flaw resides in the anonymous /api/page/render endpoint, which fails to properly escape query parameters when rendering them inside inline script elements. Attackers can craft malicious links containing script-terminating sequences in the schemaApi or data parameters to execute arbitrary JavaScript in a victim's browser session. Successful exploitation enables theft of X-Auth-Token credentials, allowing account takeover of authenticated Steedos users. The vulnerability is tracked as CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Attackers can steal X-Auth-Token credentials from authenticated Steedos users by tricking them into clicking a crafted URL, leading to session hijacking and account takeover.
Affected Products
- Steedos Platform versions through 3.0.15-beta.47
- The vulnerable service-pages module using page_render.router.js
- Deployments exposing the anonymous /api/page/render endpoint
Discovery Timeline
- 2026-09-15 - CVE-2026-91922 published to NVD
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-91922
Vulnerability Analysis
The Steedos Platform exposes an unauthenticated route at /api/page/render that generates HTML pages using an EJS template. User-controlled query parameters, specifically schemaApi and data, are interpolated directly into inline <script> blocks in the page_view.ejs template without JavaScript-context encoding. Because the reflection occurs inside a script element rather than an HTML attribute or text node, standard HTML entity escaping does not neutralize the payload. An attacker can supply a value containing a </script> sequence to break out of the script context and inject arbitrary JavaScript that executes in the origin of the Steedos instance.
Root Cause
The root cause is improper neutralization of untrusted input in a JavaScript execution context [CWE-79]. The route handler in page_render.router.js passes query parameters to the EJS template, which renders them using expressions that HTML-escape output but do not perform JavaScript string escaping. Values embedded inside <script> tags therefore retain characters such as <, >, ", and ' in their literal form, allowing the string to terminate the enclosing script element.
Attack Vector
Exploitation requires a victim with an active Steedos session to visit an attacker-controlled URL. The attacker crafts a link targeting /api/page/render with a malicious schemaApi or data query parameter containing a script-terminating sequence followed by JavaScript. When the page loads, the injected script executes with the victim's origin privileges and reads the X-Auth-Token from browser-accessible storage or cookies. The captured token can then be exfiltrated to an attacker-controlled endpoint and reused to impersonate the victim. Technical specifics are documented in the VulnCheck Advisory for Steedos and Steedos Platform Issue #8354.
Detection Methods for CVE-2026-91922
Indicators of Compromise
- Requests to /api/page/render containing </script> sequences or URL-encoded variants (%3C/script%3E) within the schemaApi or data query parameters.
- Outbound HTTP requests from user browsers to unfamiliar domains shortly after visiting a Steedos page render URL, indicating token exfiltration.
- Reuse of X-Auth-Token values from geographically or behaviorally anomalous source IP addresses.
Detection Strategies
- Inspect web server and reverse proxy logs for anomalous query strings targeting the /api/page/render endpoint, particularly those containing angle brackets, event handler names, or javascript: schemes.
- Deploy web application firewall (WAF) rules that flag reflected XSS payloads on the vulnerable path.
- Correlate authentication events with recent page render requests to identify token replay from new devices or IP addresses.
Monitoring Recommendations
- Enable full HTTP request logging on Steedos front-end proxies with query string retention for forensic review.
- Monitor for spikes in traffic to /api/page/render from external referrers such as email, messaging platforms, or social media links.
- Alert on session token usage patterns that indicate concurrent sessions or rapid geographic changes.
How to Mitigate CVE-2026-91922
Immediate Actions Required
- Restrict or disable anonymous access to the /api/page/render endpoint at the reverse proxy or load balancer until a patched Steedos release is deployed.
- Deploy WAF signatures that block requests to /api/page/render containing <, >, or </script> sequences in the schemaApi and data parameters.
- Rotate any X-Auth-Token values suspected of exposure and invalidate active sessions for high-privilege accounts.
Patch Information
As of the NVD publication date, the Steedos Platform Repository tracks the issue in Steedos Platform Issue #8354. Administrators should monitor the repository for a fixed release beyond 3.0.15-beta.47 and upgrade as soon as a patched version becomes available. Review the vulnerable Steedos Page Render Router Code and Steedos Page View EJS Template to confirm the fix applies JavaScript-context encoding.
Workarounds
- Apply strict Content Security Policy (CSP) headers that disallow inline script execution and restrict script sources to trusted origins.
- Configure the X-Auth-Token cookie with HttpOnly and SameSite=Strict attributes to prevent script access and cross-site delivery.
- Block or filter query parameters containing HTML or script metacharacters at an upstream proxy for the /api/page/render path.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
