Unauthenticated Stored Second-Order XSS in YAF.NET via User-Agent (CVE-2026-4338)

Vulnerability Overview Title: Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected Header CVE ID: CVE-2026-4338 CVSS Score: 8.1 / 10 (High) Reporter: wittcha Release Date: Last month Description: This is a stored (second-order) Cross-Site Scripting (XSS) vulnerability. Input controlled by the attacker is persisted within a component of the application and later rendered by a completely separate component without proper sanitization or context-aware output encoding. Because this vulnerability typically occurs in high-privilege administrative interfaces, the payload executes in the administrator's browser, inheriting their authenticated session. Specific Details: YAF.NET's database logger ( ) captures the header of incoming requests, serializes it into JSON, and stores it in the column. When an administrator views the logs, the Razor view ( ) renders this JSON string directly as an HTML string without encoding. An unauthenticated attacker can trigger a server-side exception by exploiting the unauthenticated endpoint , thereby writing the malicious into the log. Impact: Any unauthenticated attacker (requiring no cookies, tokens, or CSRF tokens) can implant JavaScript that will execute the next time an administrator views the Event Log. Since the script runs in the context of the administrator's authentication, the attacker can perform any administrative action, including creating new admin accounts, modifying site settings, or stealing user data through administrative endpoints. This effectively transforms a single anonymous HTTP request into a primitive for full site takeover. Exploitability: Very High. It requires only a single HTTP request to a public, unauthenticated endpoint, assuming the administrator regularly views the logs. Remediation Affected Versions: 4.0.4 <=3.2.11 Fixed Versions: 4.0.5 3.2.12 POC / Exploit Code Step 1: Send Malicious Request From an unauthenticated session, send a request containing a malicious : Step 2: Verification Confirm that the server returns an error response and that the line containing the attacker-controlled value has been written to the . Step 3: Trigger Execution Navigate to as an administrator (e.g., Superuser). Step 4: Confirmation Observe that the rendered page contains the original element and that the handler executes within the administrator's authenticated session, confirming cross-session, cross-privilege script execution.

Goal Reached Thanks to every supporter — we hit 100%!

Unauthenticated Stored Second-Order XSS in YAF.NET via User-Agent (CVE-2026-4338)

More from this source