STIG Manager has reflected XSS vulnerability in the Web App

Summary

STIG Manager is an API and web client for managing Security Technical Implementation Guides (STIG) assessments of Information Systems. Versions 1.5.10 through 1.6.7 have a reflected Cross-Site Scripting (XSS) vulnerability in the OIDC authentication error handling code in `src/init.js` and `public/reauth.html`. During the OIDC redirect flow, the `error` and `error_description` query parameters returned by the OIDC provider are written directly to the DOM via `innerHTML` without HTML escaping. An attacker who can craft a malicious redirect URL and convince a user to follow it can execute arbitrary JavaScript in the application's origin context. The vulnerability is most severe when the targeted user has an active STIG Manager session running in another browser tab — injected code executes in the same origin and can communicate with the SharedWorker managing the active access token, enabling authenticated API requests on behalf of the victim including reading and modifying collection data. The vulnerability is patched in version 1.6.8. There is no workaround short of upgrading. Deployments behind a web application firewall that filters reflected XSS payloads in query parameters may have partial mitigation, but this is not a substitute for patching.

Timeline

1. Apr 23, 2026, 12:40 AM UTCCVE published
2. Apr 23, 2026, 1:59 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Apr 23, 2026, 1:59 PM UTCRecord last updated

Affected versions

• NUWCDIVNPT stig-manager

  From 1.5.10 · fixed in 1.6.8

References 2