Is there a public PoC exploit available for CVE-2026-6493?

Yes, a public proof-of-concept exploit is available for CVE-2026-6493. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-6493?

Yes, a patch is available for CVE-2026-6493. Update the affected software to the latest version immediately.

Rallly CVE-2026-6493

Q: What is the CVSS score of CVE-2026-6493?

CVE-2026-6493 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23436 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-17 VulDB

GHSA-cv47-g53v-q848

XSS Rallly

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.1 (MEDIUM) 2.0 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 17, 2026 - 15:22 NVD

LOW MEDIUM

CVSS changed

Apr 17, 2026 - 15:22 NVD

3.5 (LOW) 5.1 (MEDIUM)

Analysis Generated

Apr 17, 2026 - 15:00 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 14:45 euvd

EUVD-2026-23436

Analysis Generated

Apr 17, 2026 - 14:45 vuln.today

Patch released

Apr 17, 2026 - 14:45 nvd

Patch available

CVE Published

Apr 17, 2026 - 14:15 nvd

LOW 2.0

DescriptionCVE.org

A flaw has been found in lukevella rallly up to 4.7.4. This affects an unknown function of the file apps/web/src/app/[locale]/(auth)/reset-password/components/reset-password-form.tsx of the component Reset Password Handler. Executing a manipulation of the argument redirectTo can lead to cross site scripting. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 4.8.0 mitigates this issue. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.

AnalysisAI

Cross-site scripting (XSS) in lukevella Rallly up to version 4.7.4 allows authenticated users to inject malicious scripts via the redirectTo parameter in the reset password form, affecting the stored XSS vector with user interaction required. The vulnerability has public exploit code available and is mitigated by upgrading to version 4.8.0 or later. Real-world risk is limited by the requirement for authenticated access and user interaction, but the publicly available exploit increases attack feasibility.

Technical ContextAI

The vulnerability exists in the Reset Password Handler component (reset-password-form.tsx) in the web application layer of Rallly, a scheduling/meeting coordination tool. The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), meaning user-supplied input in the redirectTo parameter is not properly sanitized before being rendered in the HTML response. The attack leverages the authenticated session context where a user is already logged in and clicking a malicious link. The CPE cpe:2.3:a:lukevella:rallly indicates this affects the Rallly application product across all versions up to 4.7.4.

RemediationAI

Vendor-released patch: upgrade to Rallly version 4.8.0 or later immediately. The patch is available from https://github.com/lukevella/rallly/releases/tag/v4.8.0 and addresses the input validation flaw in the reset password form. For organizations unable to upgrade immediately, a compensating control is to restrict password reset functionality to trusted networks or disable the reset-password feature entirely if account recovery is handled through alternative channels (e.g., administrator intervention); however, this significantly degrades user experience and is temporary only. A second control is to implement strict Content Security Policy (CSP) headers with script-src 'self' directive to prevent inline script execution, which mitigates XSS impact but does not address the underlying flaw. Regular security awareness training emphasizing not to click password-reset links from untrusted sources further reduces attack surface. Given the low complexity and public availability of the exploit, patching should be prioritized over relying on compensating controls.