CVE-2026-33510 - Vulnerability Analysis
HighCVSS: 8.8Last Updated: April 6, 2026
Homarr - Stored XSS
Published: April 6, 2026Updated: April 6, 2026Remote Exploitable
Overview
Homarr < 1.57.0 contains a DOM-based Cross-Site Scripting caused by improper trust of the callbackUrl parameter in /auth/login, letting attackers execute arbitrary JavaScript via crafted links, exploit requires victim to be authenticated and open the link.
Severity & Score
Severity: High
CVSS Score: 8.8
Impact
Authenticated attackers can execute arbitrary JavaScript, leading to credential theft and unauthorized actions.
Mitigation
Update to version 1.57.0 or later.
Related Resources
Details
- CVE ID
- CVE-2026-33510
- Severity
- High
- CVSS Score
- 8.8
- Type
- stored_xss
- Status
- new
CWE
- CWE-87
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L