CVE-2026-5808

A vulnerability was detected in openstatusHQ openstatus up to 1b678e71a85961ae319cbb214a8eae634059330c. This impacts an unknown function of the file apps/dashboard/src/app/(dashboard)/onboarding/client.tsx of the component Onboarding Endpoint. The manipulation of the argument callbackURL results in cross site scripting. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The patch is identified as 43d9b2b9ef8ae1a98f9bdc8a9f86d6a3dfaa2dfb. It is advisable to implement a patch to correct this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

• CWE-79
• CWE-94

• https://gist.github.com/TrebledJ/ab83abb1ca7ff6c1f39e16a37020f323
• https://github.com/openstatusHQ/openstatus/
• https://github.com/openstatusHQ/openstatus/commit/43d9b2b9ef8ae1a98f9bdc8a9f86d6a3dfaa2dfb
• https://github.com/openstatusHQ/openstatus/pull/1981
• https://vuldb.com/submit/787321
• https://vuldb.com/vuln/356245
• https://vuldb.com/vuln/356245/cti

Published

Apr 8, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-58073A vulnerability in Veeam Service Provider Console allowing a…9.5
• CVE-2026-58074A vulnerability allowing a high-privileged user to execute a…8.6
• CVE-2026-58075A vulnerability allowing an unauthenticated attacker to read…8.7
• CVE-2026-58076Apache Airflow's serialization layer reconstructed exception…8.8
• CVE-2026-58077Joomla Extension - weeblr.com - Unauthenticated stored XSS i…8.7
• CVE-2026-58078Joomla Extension - themexpert.com - Unauthenticated SQL inje…8.7
• CVE-2026-58080In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerCo…8.2
• CVE-2026-58081Several encoding modules, including HZ, UTF-7, VIQR, and ZW,…9.8
• CVE-2026-58082The ISO-2022 encoding module used a stack buffer sized to MB…9.8
• CVE-2026-58083While the kernel was copying knotes during fork, a knote wit…8.4
• CVE-2026-58084To retrieve the previous timer value, the kernel calls realt…5.5
• CVE-2026-58085After dispatching a decrypt operation to OCF and receiving t…7.5