CVE-2026-13536: GotoHTTP Cross-Site Scripting (XSS) in /reg.12x Endpoint

Technical summary

The vulnerability exists in GotoHTTP's /reg.12x endpoint, where the 'sn' parameter is processed and reflected in the response without adequate output encoding. This reflected XSS flaw (CWE-79) allows attackers to execute arbitrary JavaScript in the context of a victim's browser session. The CVSS 3.1 score of 4.3 reflects a network-based attack vector with low complexity, no privilege requirements, but mandatory user interaction and limited impact (integrity only). The CWE-94 classification suggests potential code evaluation risks depending on how the parameter is processed downstream.

Business impact

Organizations running GotoHTTP can face reputational damage if users are compromised through malicious links. Attackers could steal session cookies, perform actions on behalf of authenticated users, or redirect users to phishing sites. The low CVSS score reflects the requirement for social engineering to trick users into clicking a malicious link, but the attack surface remains open until a patch is applied. The vendor's decision to defer remediation to the next major release leaves organizations exposed during an interim period.

Affected systems

All GotoHTTP installations up to version 10.2 are affected. The vendor has not disclosed version numbers or product variants; organizations using any version in this range should assess their exposure. The vulnerability is endpoint-specific to /reg.12x, limiting the attack surface compared to application-wide flaws, but any exposure of this endpoint is a concern.

Exploitability

The exploit has been publicly disclosed, lowering the barrier to discovery and use by threat actors. Exploitation requires crafting a URL with a malicious payload in the 'sn' parameter and socially engineering a user to click it—a reliable but not highly automated attack pattern. The lack of authentication or privilege requirements means attackers do not need valid credentials. However, the vendor's characterization that the URL would not normally be exposed to users in the browser should be verified independently; attack vectors may exist beyond the vendor's intended use case.

Remediation

The vendor has patched the underlying code by removing the unnecessary parameter echo. However, no official versioned release with the fix is currently available. Organizations should monitor the vendor's release schedule for the next version containing this remediation. Interim mitigations include input validation, output encoding, or restricting access to the /reg.12x endpoint if it is not actively used. A Web Application Firewall (WAF) rule blocking suspicious payloads in the 'sn' parameter can provide temporary protection.

Patch guidance

No patched version number has been formally released as of the vulnerability publication date. The vendor has indicated the fix will be included in the next major release. Organizations should subscribe to GotoHTTP's advisory channels and release notes to identify when a patched version becomes available. When a patch is released, verify the fix against the vendor's published advisory before deployment. Interim protective measures are recommended while awaiting the official patch.

Detection guidance

Monitor web server logs for requests to /reg.12x with unusual or base64-encoded payloads in the 'sn' parameter, particularly those containing script tags or event handlers (e.g., <script>, onerror=, onclick=). Implement WAF rules to block requests containing common XSS patterns in this parameter. Network-based detection should look for suspicious URL patterns targeting this endpoint. Endpoint Detection and Response (EDR) tools can monitor for unexpected JavaScript execution in browsers on affected systems.

Why prioritize this

This vulnerability merits prompt but not emergency attention. The CVSS score of 4.3 (MEDIUM) and user-interaction requirement lower the immediate risk compared to unauthenticated remote code execution flaws. However, public disclosure of the exploit and the lack of a patched version create ongoing exposure. Organizations with public-facing GotoHTTP instances or high-risk user populations should prioritize remediation; those with internal-only deployments can adopt interim mitigations while waiting for an official patch.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects: (1) network-accessible attack vector with low complexity; (2) no privilege or authentication requirement; (3) mandatory user interaction (clicking a malicious link); (4) limited impact to integrity (unauthorized modification via injected script) with no confidentiality or availability impact. The score appropriately weights the public disclosureto increase practical urgency despite the technical severity being moderate.

Frequently asked questions