CVE-2026-6493
lukevella rallly Reset Password reset-password-form.tsx cross site scripting
- State
- Published
- Severity
- 5.1 Medium
- Published
- Apr 17, 2026
- Updated
- Apr 20, 2026
- Reserved
- Apr 17, 2026
Description
A flaw has been found in lukevella rallly up to 4.7.4. This affects an unknown function of the file apps/web/src/app/[locale]/(auth)/reset-password/components/reset-password-form.tsx of the component Reset Password Handler. Executing a manipulation of the argument redirectTo can lead to cross site scripting. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 4.8.0 mitigates this issue. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 3.5 Low | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C | VulDB |
| 3.0 | 3.5 Low | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C | VulDB |
| 2.0 | 4.0 Medium | AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
ralllylukevella |
|
References
- VDB-358037 | lukevella rallly Reset Password reset-password-form.tsx cross site scriptingvdb-entrytechnical-description
- VDB-358037 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #787347 | lukevella rallly 4.7.5 DOM-Based XSS, Open Redirectthird-party-advisory
- https://gist.github.com/TrebledJ/0bd0494a28daaa16abb565b2cef4bd7cexploit
- https://github.com/lukevella/rallly/pull/2245issue-trackingpatch
- https://github.com/lukevella/rallly/releases/tag/v4.8.0patch
- https://github.com/lukevella/rallly/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.