CVE-2026-17532

Name of the Vulnerable Software and Affected Versions Seraphinite Accelerator versions prior to 2.29.16

Description Unauthenticated attackers can inject arbitrary web scripts into pages by tricking a user into clicking a specially crafted link. This occurs via the 'seraph accel prep' parameter. The issue stems from the CacheExtractPreparePageParams() function using a loose inequality operator (!=) to compare an expected HMAC string against a JSON-decoded nonce value; providing a JSON boolean true allows the signature check to be bypassed. Additionally, the CbContentFinishSkip() function fails to properly escape output, directly concatenating the attacker-controlled selfTest field into the HTML response body.

Recommendations Update to a version newer than 2.29.15.