EIP-2026-104186

This is a technical writeup detailing an unauthenticated reflected XSS vulnerability in BeyondTrust Remote Support 6.0 and earlier versions. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the login[password] parameter in the /appliance/login endpoint.