CVE-2026-41200
STIG Manager has reflected XSS vulnerability in the Web App
Description
STIG Manager is an API and web client for managing Security Technical Implementation Guides (STIG) assessments of Information Systems. Versions 1.5.10 through 1.6.7 have a reflected Cross-Site Scripting (XSS) vulnerability in the OIDC authentication error handling code in `src/init.js` and `public/reauth.html`. During the OIDC redirect flow, the `error` and `error_description` query parameters returned by the OIDC provider are written directly to the DOM via `innerHTML` without HTML escaping. An attacker who can craft a malicious redirect URL and convince a user to follow it can execute arbitrary JavaScript in the application's origin context. The vulnerability is most severe when the targeted user has an active STIG Manager session running in another browser tab — injected code executes in the same origin and can communicate with the SharedWorker managing the active access token, enabling authenticated API requests on behalf of the victim including reading and modifying collection data. The vulnerability is patched in version 1.6.8. There is no workaround short of upgrading. Deployments behind a web application firewall that filters reflected XSS payloads in query parameters may have partial mitigation, but this is not a substitute for patching.
INFO
Published Date :
April 23, 2026, 2:16 a.m.
Last Modified :
Oct. 26, 2026, 9:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Upgrade STIG Manager to version 1.6.8.
- Apply vendor patches when available.
Public PoC/Exploit Available at Github
CVE-2026-41200 has a 2 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-41200.
| URL | Resource |
|---|---|
| https://github.com/NUWCDIVNPT/stig-manager/security/advisories/GHSA-wg33-j3rv-jq72 |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-41200 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-41200
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
Python
📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
security cve exploit poc vulnerability
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-41200 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-41200 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 26, 2026
Action Type Old Value New Value Added Translation Title: stig-manager de NUWCDIVNPT, Description: STIG Manager es una API y un cliente web para gestionar evaluaciones de las Guías de Implementación Técnica de Seguridad (STIG) de Sistemas de Información. Las versiones 1.5.10 hasta 1.6.7 tienen una vulnerabilidad de cross-site scripting (XSS) reflejado en el código de manejo de errores de autenticación OIDC en ’src/init.js’ y ’public/reauth.html’. Durante el flujo de redirección OIDC, los parámetros de consulta ’error’ y ’error_description’ devueltos por el proveedor OIDC se escriben directamente en el DOM a través de ’innerHTML’ sin escape HTML. Un atacante que puede crear una URL de redirección maliciosa y convencer a un usuario para que la siga puede ejecutar JavaScript arbitrario en el contexto de origen de la aplicación. La vulnerabilidad es más grave cuando el usuario objetivo tiene una sesión activa de STIG Manager ejecutándose en otra pestaña del navegador - el código inyectado se ejecuta en el mismo origen y puede comunicarse con el SharedWorker que gestiona el token de acceso activo, lo que permite solicitudes de API autenticadas en nombre de la víctima, incluyendo la lectura y modificación de datos de la colección. La vulnerabilidad está parcheada en la versión 1.6.8. No hay solución alternativa aparte de actualizar. Las implementaciones detrás de un cortafuegos de aplicaciones web que filtra cargas útiles de XSS reflejado en los parámetros de consulta pueden tener una mitigación parcial, pero esto no sustituye el parcheo. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'NUWCDIVNPT', 'product': 'stig-manager', 'versions': [{'status': 'affected', 'version': '>= 1.5.10, < 1.6.8'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-41200', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-04-23T13:59:38.322359Z'} -
New CVE Received by [email protected]
Apr. 23, 2026
Action Type Old Value New Value Added Description STIG Manager is an API and web client for managing Security Technical Implementation Guides (STIG) assessments of Information Systems. Versions 1.5.10 through 1.6.7 have a reflected Cross-Site Scripting (XSS) vulnerability in the OIDC authentication error handling code in `src/init.js` and `public/reauth.html`. During the OIDC redirect flow, the `error` and `error_description` query parameters returned by the OIDC provider are written directly to the DOM via `innerHTML` without HTML escaping. An attacker who can craft a malicious redirect URL and convince a user to follow it can execute arbitrary JavaScript in the application's origin context. The vulnerability is most severe when the targeted user has an active STIG Manager session running in another browser tab — injected code executes in the same origin and can communicate with the SharedWorker managing the active access token, enabling authenticated API requests on behalf of the victim including reading and modifying collection data. The vulnerability is patched in version 1.6.8. There is no workaround short of upgrading. Deployments behind a web application firewall that filters reflected XSS payloads in query parameters may have partial mitigation, but this is not a substitute for patching. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-79 Added Reference https://github.com/NUWCDIVNPT/stig-manager/security/advisories/GHSA-wg33-j3rv-jq72