CVE-2026-6493

LOW

lukevella rallly Reset Password reset-password-form.tsx cross site scripting

Title source: cna
STIX 2.1

Description

A flaw has been found in lukevella rallly up to 4.7.4. This affects an unknown function of the file apps/web/src/app/[locale]/(auth)/reset-password/components/reset-password-form.tsx of the component Reset Password Handler. Executing a manipulation of the argument redirectTo can lead to cross site scripting. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 4.8.0 mitigates this issue. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.

References (7)

Core 7
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-358037 | lukevella rallly Reset Password reset-password-form.tsx cross site scripting
https://vuldb.com/vuln/358037
Signature, Permissions Required signature permissions-required
VDB-358037 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/358037/cti
Third Party Advisory third-party-advisory
Submit #787347 | lukevella rallly 4.7.5 DOM-Based XSS, Open Redirect
https://vuldb.com/submit/787347

Scores

CVSS v3 3.5
EPSS 0.0026
EPSS Percentile 17.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79 CWE-94
Status published
Products (6)
lukevella/rallly 4.7.0
lukevella/rallly 4.7.1
lukevella/rallly 4.7.2
lukevella/rallly 4.7.3
lukevella/rallly 4.7.4
lukevella/rallly 4.8.0
Published Apr 17, 2026
Tracked Since Apr 17, 2026