CVE-2026-41200

HIGH

STIG Manager has reflected XSS vulnerability in the Web App

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-41200 has a selected CVSS score of 8.5 (high); EIP currently links 1 repository PoC.

Description

STIG Manager is an API and web client for managing Security Technical Implementation Guides (STIG) assessments of Information Systems. Versions 1.5.10 through 1.6.7 have a reflected Cross-Site Scripting (XSS) vulnerability in the OIDC authentication error handling code in `src/init.js` and `public/reauth.html`. During the OIDC redirect flow, the `error` and `error_description` query parameters returned by the OIDC provider are written directly to the DOM via `innerHTML` without HTML escaping. An attacker who can craft a malicious redirect URL and convince a user to follow it can execute arbitrary JavaScript in the application's origin context. The vulnerability is most severe when the targeted user has an active STIG Manager session running in another browser tab — injected code executes in the same origin and can communicate with the SharedWorker managing the active access token, enabling authenticated API requests on behalf of the victim including reading and modifying collection data. The vulnerability is patched in version 1.6.8. There is no workaround short of upgrading. Deployments behind a web application firewall that filters reflected XSS payloads in query parameters may have partial mitigation, but this is not a substitute for patching.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 23, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

stig-manager

Browse NUWCDIVNPT / stig-manager
CVE List>= 1.5.10, < 1.6.8affected

Proofs of concept

1

Repository PoCs

GitHubHunt-Benito/cve-2026-41200-stig-manager-oidc-reflected-xssRepository PoCby Hunt-Benito0Exploit2 files

6.3 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that generates a malicious OIDC callback URL containing a reflected XSS payload. The payload exploits an innerHTML injection in STIG Manager to steal access tokens via a SharedWorker or exfiltrate cookies.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward script that generates a malicious URL exploiting the described CVE-2026-41200 reflected XSS. It constructs payloads that, when rendered by a vulnerable STIG Manager instance, would exfiltrate tokens or cookies to an attacker-controlled host. The code contains no concealed, deceptive, or unrelated harmful behavior; it operates exactly as documented for a conceptual proof-of-concept.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwarestig-manager
Attack typescross-site scripting (xss)credential theft
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script generates a URL containing a crafted XSS payload designed to execute arbitrary JavaScript in the victim's browser, steal access tokens, and exfiltrate data. This is code intended to exercise a vulnerability, not merely detect it.

cve-2026-41200-poc.py:29-50cve-2026-41200-poc.py:58-64

Requirements

  • Victim must visit the crafted malicious URL while having an active STIG Manager session in another browser tab for the SharedWorker token theft mode.README.md:9
  • Attacker must control or know the STIG Manager callback URL and optionally the API and exfiltration hosts.cve-2026-41200-poc.py:72-86

Observed behavior

  • Constructs a URL with an 'error_description' query parameter containing a JavaScript payload that, when rendered by the vulnerable application, creates a SharedWorker to steal an access token and exfiltrate it along with collection data to an attacker-controlled host.cve-2026-41200-poc.py:29-50
  • Provides a simple mode that injects a script tag to exfiltrate the victim's cookies.cve-2026-41200-poc.py:53-55
  • Outputs the malicious URL in plain, curl, or HTML phishing link formats.cve-2026-41200-poc.py:120-129
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exfiltration Endpoint
{exfil_host}/collectThe sharedworker payload sends stolen tokens and collection data to an attacker-specified exfiltration host.cve-2026-41200-poc.py:38-42
Exfiltration Endpoint
{exfil_host}/fallbackThe sharedworker payload fallback sends document cookies to an attacker-specified host.cve-2026-41200-poc.py:48
Exfiltration Endpoint
{exfil_host}/stealThe simple payload sends document cookies to an attacker-specified host.cve-2026-41200-poc.py:54
Review boundaries

What the analysis did not establish

  • The script is described as 'conceptual' and may not function without a properly configured listener on the exfiltration host.
  • The evidence does not include the SharedWorker script (/worker.js) that the payload attempts to instantiate.
  • Only the two text files (README.md and cve-2026-41200-poc.py) were reviewed; no other files were present in the artifact.
  • The review does not assess the safety or correctness of the PoC when used against a real target, only whether the artifact itself contains backdoor behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

1