EUVD-2026-30284
GHSA-pqwf-7gjw-fvph
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No privileges needed to inject payload (PR:N), but admin must view logs (UI:R); scope changes to admin browser context (S:C) enabling limited session confidentiality and integrity impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Verba is affected by a Stored Cross-Site Scripting (XSS) vulnerability within its login logging mechanism. When an unauthenticated remote attacker attempts to log in using an incorrect username and password combination, the supplied username value is recorded in the application logs. Due to lack of input sanitization, an attacker can inject a malicious XSS payload into the username field. This payload will be executed in the context of the administrator’s browser when the admin accesses the web application's log viewer.
The vendor was notified early about this vulnerability, but didn't respond to our messages. This issue was fixed in version 10.0.6
AnalysisAI
Stored XSS in Verba's login audit logging subsystem allows unauthenticated remote attackers to inject arbitrary JavaScript by supplying a malicious username during a failed login attempt. The payload persists unsanitized in application logs and executes within an administrator's browser session when the log viewer is accessed, enabling potential session hijacking or credential theft. No active exploitation has been confirmed (absent from CISA KEV; EPSS 0.17% at 38th percentile), and a vendor-released fix is available in version 10.0.6.
Technical ContextAI
Verba, developed by Verint (CPE: cpe:2.3:a:verint:verba:*:*:*:*:*:*:*:*), is a call recording and workforce optimization platform. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS): the login event logging subsystem writes the attacker-controlled username field to an audit log without applying output encoding or input sanitization. Because the application's web-based log viewer later renders these log entries directly in the browser DOM, any embedded script is interpreted and executed. The impact scope crosses component boundaries - the injection occurs at the unauthenticated login endpoint, while execution occurs in the privileged administrative log viewer, which is why the CVSS 4.0 vector carries subsequent-system confidentiality and integrity impact (SC:L/SI:L) rather than direct vulnerable-system impact.
RemediationAI
Upgrade Verba to version 10.0.6 or later, which addresses the missing input sanitization in the login logging mechanism. The fix was confirmed in the CVE description and corroborated by EUVD-2026-30284; details are available via the CERT-PL advisory at https://cert.pl/en/posts/2026/05/CVE-2026-21730. Note that the vendor was unresponsive during coordinated disclosure, so independent post-upgrade testing of the log viewer is advisable to confirm the fix is effective. As a compensating control prior to patching, restrict access to the web-based log viewer to the minimum number of administrators required and enforce multi-factor authentication on all admin accounts to reduce the session-hijacking impact window. A WAF rule encoding or stripping JavaScript constructs from the username parameter at the perimeter can reduce injection success without eliminating the root cause. Reducing the frequency with which administrators access the log viewer also limits exposure, though this trades visibility for risk reduction.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today