Home

Description

The error_description parameter is vulnerable to Reflected XSS. An attacker can bypass the domain's WAF using a Safari-specific onpagereveal payload.

PUBLISHED Reserved 2026-03-09 | Published 2026-03-20 | Updated 2026-03-23 | Assigner rapid7




MEDIUM: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L

Problem types

CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')

Product status

Default status
unaffected

Any version
unknown

Credits

Christopher O’Boyle, Cybersecurity Advisor at Rapid7 finder

References

www.rapid7.com/...t-assist-information-disclosure-xss-fixed/ third-party-advisory

communities.gainsight.com/...-31381-and-cve-2026-31382-30587 vendor-advisory

cve.org (CVE-2026-31382)

nvd.nist.gov (CVE-2026-31382)

Download JSON