CVE-2026-53473

A flaw was found in migration-planner-ui-app. An attacker can register a malicious discovery agent with a specially crafted credentialUrl containing JavaScript code. When an organizational user clicks this link in the user interface, the embedded malicious code executes within the user's browser session. This cross-site scripting (XSS) vulnerability allows the attacker to compromise the victim's Red Hat Single Sign-On (SSO) session, potentially leading to unauthorized cross-tenant data access and API actions.

• CWE-79

• https://access.redhat.com/security/cve/CVE-2026-53473Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2487107Issue Tracking, Third Party Advisory
• https://github.com/kubev2v/migration-planner-ui-app/pull/750Patch

Published

Jun 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53466ImageMagick is free and open-source software used for editin…6.5
• CVE-2026-53467ImageMagick is free and open-source software used for editin…5.3
• CVE-2026-53469A flaw was found in migration-planner. An authenticated user…8.1
• CVE-2026-5347The HM Books Gallery plugin for WordPress is vulnerable to M…5.3
• CVE-2026-53470A flaw was found in migration-planner. An authenticated atta…8.1
• CVE-2026-53471A flaw was found in migration-planner. The agent-API middlew…7.7
• CVE-2026-53474A flaw was found in migration-planner. A remote authenticate…6.5
• CVE-2026-53475A flaw was found in assisted-migration-agent. The applicatio…7.4
• CVE-2026-53476A flaw was found in assisted-migration-agent. An unauthentic…9.6
• CVE-2026-53478Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7,…7.2
• CVE-2026-53479Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7,…7.2
• CVE-2026-5348The Academy LMS – WordPress LMS Plugin for Complete eLearnin…5.3