CVE-2026-45778

Name of the Vulnerable Software and Affected Versions OpenXDMoD versions prior to 11.0.3

Description An authenticated attacker can inject malicious JavaScript into their user profile and abuse the password reset functionality to send a link to an HTML page. When a victim visits this page, the unsanitized payload is reflected and executed in the browser, which may lead to credential capture and account takeover. This is a Reflected Cross-Site Scripting (XSS) issue, where a script is reflected off a web application to the victim's browser.

Recommendations Update to version 11.0.3. As a temporary workaround, apply the patch manually.