CVE-2026-45778: Open XDMoD Vulnerable to Reflected Cross-Site Scripting (XSS) in Password Reset

Synopsis

Reflected cross-site scripting (XSS) in Open XDMoD allows an authenticated attacker to inject malicious JavaScript into their user profile and weaponize the password reset email flow to deliver a crafted link to a victim. The attack is reachable over the network, requires a low-privilege account on the attacker's side, and requires the victim to visit the malicious link. Successful exploitation gives the attacker full read and write access to the victim's Open XDMoD session, enabling credential capture and account takeover. A patched-image rebuild at version 11.0.3 is available on HarborGuard for environments running an affected version of ubccr/xdmod.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Open XDMoD service over the network to inject the payload and trigger the password reset email flow.

• AuthenticationRequired

  A low-privilege Open XDMoD user account is sufficient; no administrative access is needed to stage the attack.

• Victim interactionRequired

  The victim must visit the crafted password reset link delivered via email before the malicious JavaScript executes in their browser.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors are required to stage or deliver the payload.

Blast Radius

• Reads the victim's active session tokens and any credential material visible in the browser context.
• Performs account takeover by capturing or resetting the victim's Open XDMoD credentials.
• Modifies the victim's Open XDMoD profile and any HPC metrics data the victim's account is authorized to change.
• Partially disrupts the victim's Open XDMoD access (low availability impact on the victim component per CVSS scoring).