CVE-2020-5497

PoC ×3—

CVSS 3.1

6.1 medium

EPSS

2%p81

Published

Jan 4, 2020 (Jan 4, 2020)

Modified

Jun 17, 2026

Description

The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized. This is related to header.tag. The issue can be exploited to execute arbitrary JavaScript.

Vendors: mitreid
Products: connect
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (2.1%)

In the news0 stories

No ingested article mentions this CVE yet.