Description

Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T15:17:02.340Z",
  "pubdate": "2026-08-18T15:17:02.340Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability exists in the Autopay product affecting versions 5.0.0 and below. This security flaw permits remote unauthenticated malicious actors to inject arbitrary client-side scripts, such as malignant JavaScript, into web pages rendered to legitimate users of the application. The primary impact of this vulnerability includes session hijacking, credential theft, redirection to malicious destinations, and unauthorized actions performed within the context of the victim's browser session. The risk implication is high, as successful exploitation requires no prior authentication or privileged access, lowering the barrier to entry for external attackers. Exploitation relies on the application failing to properly sanitize or encode user-supplied input before reflecting or rendering it back within the Document Object Model (DOM). Consequently, any unauthenticated network-adjacent user can trigger the payload by interacting with a crafted URL or manipulated input vector processed by the vulnerable Autopay components.",
  "technicalDetails": "The vulnerability is an unauthenticated Cross-Site Scripting (XSS) flaw localized within the input handling and output rendering mechanisms of Autopay versions 5.0.0 and below. The root cause stems from insufficient input validation and a lack of contextual output encoding, which permits malicious payloads containing HTML or JavaScript directives to be processed directly by the web application. Because the vulnerability is exposed without requiring authentication or specific privileges, any remote user operating over the network can interact with the vulnerable endpoints.\nThe attack flow begins when an unauthenticated attacker crafts a malicious URL or input vector containing an encoded JavaScript payload designed to execute within the victim's browser context. When a target user visits the manipulated endpoint or interacts with the vulnerable component, the application accepts the untrusted input and improperly embeds it directly into the Hypertext Markup Language (HTML) response without adequate neutralization.\nUpon receiving the payload, the victim's browser parses the HTTP response and executes the injected script as legitimate application code due to the absence of proper Content Security Policy (CSP) headers or output sanitization routines. The payload behavior can range from executing arbitrary Document Object Model (DOM) manipulation to extracting sensitive data such as session cookies, authorization tokens, or personally identifiable information accessible via local storage or DOM properties.\nThe post-exploitation impact of this vulnerability allows the attacker to perform actions on behalf of the authenticated victim, potentially escalating privileges within the application depending on the target user's role. The affected component involves the request handling routines responsible for processing and reflecting unauthenticated parameters in Autopay <= 5.0.0."
}