CVE-2026-41200

🗓️ 23 Apr 2026 00:40:23Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 5 Views🌐 WEB

STIG Manager has a reflected cross-site scripting vulnerability in OpenID Connect error handling; upgrade to version 1.6.8.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2026-41200	23 Apr 202600:40	–	attackerkb
Circl	CVE-2026-41200	23 Apr 202605:18	–	circl
CNNVD	STIG Manager 跨站脚本漏洞	23 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-41200 STIG Manager has reflected XSS vulnerability in the Web App	23 Apr 202600:40	–	cvelist
EUVD	EUVD-2026-25158	23 Apr 202600:40	–	euvd
GithubExploit	Exploit for CVE-2026-41200	2 May 202605:49	–	githubexploit
NVD	CVE-2026-41200	23 Apr 202602:16	–	nvd
Positive Technologies	PT-2026-34595	23 Apr 202600:00	–	ptsecurity

Vulners

Node

nuwcdivnpt stig-managerRange1.5.10–1.6.8

[
  {
    "vendor": "NUWCDIVNPT",
    "product": "stig-manager",
    "versions": [
      {
        "version": ">= 1.5.10, < 1.6.8",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/NUWCDIVNPT/stig-manager/security/advisories/GHSA-wg33-j3rv-jq72

Parameter	Position	Path	Description	CWE
error	query param	auth/callback	Reflected XSS via OIDC redirect where error params are written to DOM without escaping	CWE-79
error_description	query param	auth/callback	Reflected XSS via OIDC redirect where error params are written to DOM without escaping	CWE-79

29 Apr 2026 20:46Current

6.1Medium risk

Vulners AI Score6.1

CVSS 48.5

EPSS0.00069

CWE-79