CVE-2026-45778: OpenXDMoD Stored XSS and Account Takeover via Password Reset Abuse

Technical summary

The vulnerability is a stored XSS flaw (CWE-79) in OpenXDMoD's user profile functionality paired with improper sanitization of HTML in password reset emails. An attacker with valid credentials crafts a malicious JavaScript payload and stores it in their profile. When the attacker triggers the password reset feature and provides a victim's email address, the system generates a reset link containing an HTML page that reflects the unsanitized profile data. The reflected content executes in the victim's browser context, bypassing Same-Origin Policy protections due to the cross-site (S:C) scope. The attack requires user interaction (UI:R) — specifically that the victim click the password reset link — but no additional privileges or complex exploitation steps.

Business impact

This vulnerability poses a direct threat to account security within HPC environments, which often manage sensitive research data and computational resources. Attackers can impersonate legitimate users, access their research outputs, modify job submissions, or pivot to connected systems. In multi-tenant HPC facilities, compromised accounts create lateral movement opportunities. The impact is amplified in environments where OpenXDMoD credentials are shared or reused across other systems. For organizations relying on OpenXDMoD for resource accountability and metering, account takeover disrupts audit trails and compliance reporting.

Affected systems

All OpenXDMoD deployments prior to version 11.0.3 are vulnerable. This includes standalone deployments and those integrated into larger HPC infrastructure. The vulnerability requires the attacker to already possess valid OpenXDMoD credentials; public-facing instances with open registration or instances accessible to insider threats are at heightened risk. No evidence of exploitation in the wild as of the publication date.

Exploitability

Exploitability is moderate. The attack requires an authenticated account (reducing the pool of potential attackers to internal users or those with compromised credentials), but once inside, the attack chain is straightforward: inject payload, trigger password reset, send link to target. The victim interaction requirement (clicking the reset link) is a realistic social engineering scenario, especially if the attacker crafts a convincing pretext. No complex tooling or advanced evasion is needed. The vulnerability does not lead to remote code execution on the server or privilege escalation beyond account takeover.

Remediation

Immediately upgrade OpenXDMoD to version 11.0.3 or later, released 2026-05-12. The patch includes input sanitization in user profiles and proper output encoding in password reset emails. For organizations unable to upgrade immediately, the vendor recommends manual patching; verify the specific patch availability in the OpenXDMoD advisory. No supported versions prior to 11.0.3 are mentioned as receiving backports.

Patch guidance

Apply OpenXDMoD 11.0.3 or later. Follow the vendor's upgrade documentation to ensure configuration and data preservation. Test the upgrade in a non-production environment first to validate compatibility with any local customizations. If immediate patching is infeasible, the vendor notes that manual patching is available as a temporary workaround; refer to the official advisory for patch details and application steps. Verify patch application by confirming the version string in the OpenXDMoD web interface.

Detection guidance

Monitor for signs of profile injection attempts: watch for unusual character sequences in user profile updates (especially JavaScript keywords, HTML tags, event handlers). Log and alert on suspicious password reset requests, particularly those targeting high-privilege accounts or sent in rapid succession. Review password reset email logs for requests originating from internal users. In web proxy or application firewall logs, look for encoded JavaScript payloads in POST requests to profile endpoints. Audit successful logins shortly after password reset events to detect account takeovers. Review audit logs for changes to user roles or permissions following suspected exploitation.

Why prioritize this

Despite a MEDIUM CVSS score (5.4), this vulnerability merits prompt attention because it enables account takeover in an environment managing computational resources and potentially sensitive research data. The attack requires only valid credentials (an insider threat or credential compromise scenario) and basic social engineering. HPC facilities often have limited security monitoring relative to enterprise IT, making detection harder post-exploitation. The six-day gap between private disclosure (2026-04-06) and public release (2026-06-05) suggests responsible disclosure was followed, reducing the window of unpatched exposure. However, the lack of KEV status and no evidence of in-the-wild exploitation suggest lower immediate threat. Prioritize based on organizational risk: high if OpenXDMoD is exposed to untrusted users or if credential compromise is a concern; moderate for internal-only deployments with strong access controls.

Risk score, explained

The CVSS 3.1 score of 5.4 (MEDIUM) reflects several factors: Network accessibility (AV:N) and low attack complexity (AC:L) increase reach; however, the requirement for prior authentication (PR:L) significantly reduces the threat surface. User interaction (UI:R) further constraints exploitability. The impact is limited to confidentiality and integrity (C:L, I:L) with no availability impact (A:N), as the attacker cannot disrupt the service itself. The changed scope (S:C) acknowledges that the payload executes in the victim's browser outside the original security boundary. The score appropriately reflects a serious but not critical vulnerability; elevation to HIGH would require unauthenticated access or broader impact.

Frequently asked questions