CVE-2024-26318

—

CVSS 3.1

6.1 medium

EPSS

<1%p32

Published

Feb 19, 2024 (Feb 19, 2024)

Modified

Jun 17, 2026

Description

Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character.

Vendors: serenity
Products: serenity
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.