CVE-2026-33510

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33510", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-20T16:59:08.889Z", "datePublished": "2026-04-06T14:51:38.960Z", "dateUpdated": "2026-04-06T15:41:01.491Z"}, "containers": {"cna": {"title": "DOM-Based XSS in Homarr /auth/login Redirect", "problemTypes": [{"descriptions": [{"cweId": "CWE-87", "lang": "en", "description": "CWE-87: Improper Neutralization of Alternate XSS Syntax", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/homarr-labs/homarr/security/advisories/GHSA-79pg-554g-rw82", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/homarr-labs/homarr/security/advisories/GHSA-79pg-554g-rw82"}], "affected": [{"vendor": "homarr-labs", "product": "homarr", "versions": [{"version": "< 1.57.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T14:51:38.960Z"}, "descriptions": [{"lang": "en", "value": "Homarr is an open-source dashboard. Prior to 1.57.0, a DOM-based Cross-Site Scripting (XSS) vulnerability has been discovered in Homarr's /auth/login page. The application improperly trusts a URL parameter (callbackUrl), which is passed to redirect and router.push. An attacker can craft a malicious link that, when opened by an authenticated user, performs a client-side redirect and executes arbitrary JavaScript in the context of their browser. This could lead to credential theft, internal network pivoting, and unauthorized actions performed on behalf of the victim. This vulnerability is fixed in 1.57.0."}], "source": {"advisory": "GHSA-79pg-554g-rw82", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/homarr-labs/homarr/security/advisories/GHSA-79pg-554g-rw82", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-06T15:31:30.934996Z", "id": "CVE-2026-33510", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T15:41:01.491Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33510", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T15:31:30.934996Z"}}}], "references": [{"url": "https://github.com/homarr-labs/homarr/security/advisories/GHSA-79pg-554g-rw82", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T15:31:44.902Z"}}], "cna": {"title": "DOM-Based XSS in Homarr /auth/login Redirect", "source": {"advisory": "GHSA-79pg-554g-rw82", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "homarr-labs", "product": "homarr", "versions": [{"status": "affected", "version": "< 1.57.0"}]}], "references": [{"url": "https://github.com/homarr-labs/homarr/security/advisories/GHSA-79pg-554g-rw82", "name": "https://github.com/homarr-labs/homarr/security/advisories/GHSA-79pg-554g-rw82", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Homarr is an open-source dashboard. Prior to 1.57.0, a DOM-based Cross-Site Scripting (XSS) vulnerability has been discovered in Homarr's /auth/login page. The application improperly trusts a URL parameter (callbackUrl), which is passed to redirect and router.push. An attacker can craft a malicious link that, when opened by an authenticated user, performs a client-side redirect and executes arbitrary JavaScript in the context of their browser. This could lead to credential theft, internal network pivoting, and unauthorized actions performed on behalf of the victim. This vulnerability is fixed in 1.57.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-87", "description": "CWE-87: Improper Neutralization of Alternate XSS Syntax"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T14:51:38.960Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33510", "state": "PUBLISHED", "dateUpdated": "2026-04-06T15:41:01.491Z", "dateReserved": "2026-03-20T16:59:08.889Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-06T14:51:38.960Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "homarr", "vendor": "homarr-labs", "versions": [{"status": "affected", "version": "< 1.57.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:homarr:homarr:*:*:*:*:*:*:*:*", "matchCriteriaId": "734B6AEF-40FE-4B67-A3B1-66BCB31D30C9", "versionEndExcluding": "1.57.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Homarr is an open-source dashboard. Prior to 1.57.0, a DOM-based Cross-Site Scripting (XSS) vulnerability has been discovered in Homarr's /auth/login page. The application improperly trusts a URL parameter (callbackUrl), which is passed to redirect and router.push. An attacker can craft a malicious link that, when opened by an authenticated user, performs a client-side redirect and executes arbitrary JavaScript in the context of their browser. This could lead to credential theft, internal network pivoting, and unauthorized actions performed on behalf of the victim. This vulnerability is fixed in 1.57.0."}], "id": "CVE-2026-33510", "lastModified": "2026-06-17T10:37:37.640", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.3, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.3, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33510", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-06T15:31:30.934996Z", "version": "2.0.3"}}]}, "published": "2026-04-06T15:17:10.790", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/homarr-labs/homarr/security/advisories/GHSA-79pg-554g-rw82"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/homarr-labs/homarr/security/advisories/GHSA-79pg-554g-rw82"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-87"}, {"lang": "en", "value": "CWE-601"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.57.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "homarr", "source": "cna", "vendor": "homarr-labs"}, "product": "homarr", "vendor": "homarr-labs"}], "analysis": {"en": {"generated_at": "2026-04-09T19:27:06.299085+00:00", "value": {"mitigation_remediation": ["Upgrade Homarr to version 1.57.0 or later."], "summary": {"action": "Patch", "impact": "Client-side Code Execution"}, "threat_synthesis": {"affected_systems": "The flaw affects homarr-labs' Homarr product versions prior to 1.57.0. Any deployment of Homarr running an earlier release and exposing the /auth/login endpoint is vulnerable.", "description_and_impact": "Homarr, an open-source dashboard, contains a DOM-based Cross-Site Scripting vulnerability in the /auth/login page. The application mistakenly trusts the \"callbackUrl\" URL parameter, passing it directly to the redirect function. An attacker can craft a malicious link that, when accessed by an authenticated user, forces a client-side redirect and injects arbitrary JavaScript into the browser. This leads to credential theft, potential internal network pivoting, and the execution of unauthorized actions in the victim\u2019s context. The weakness is classified as CWE\u2011601 (Open Redirect) and CWE\u201187 (Insertion of Code with Unescaped Input).", "risk_and_exploitability": "The CVSS score of 8.8 indicates a high severity, while the very low EPSS score (<1%) suggests that exploitation is currently uncommon. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the victim to be authenticated and to click the crafted link. Once triggered, the attacker can run JavaScript in the user's browser, enabling a range of client-side attacks such as session hijacking or phishing.*"}}}}, "created": "2026-04-06T20:14:19.110239+00:00", "updated": "2026-04-10T09:45:17.438311+00:00", "vendors": ["homarr-labs", "homarr-labs$PRODUCT$homarr"]}