markartamonov/opennebula-cve-2025-56534Stored XSS exploit for OpenNebula 6.10.0.1 via custom authenticator driver, with proof-of-concept payload and fix guidance for upgrading to version 7.0.
Exploit Title : OpenNebula 6.10.0.1 - Stored XSS (Cross-site Scripting) in the custom authenticator driver
Exploit Author : Mark Artamonov
Vendor Homepage : https://opennebula.io/
Tested Version : OpenNebula 6.10.0.1
Affected Versions : OpenNebula < 7.0
Affected Component : opennebula-sunstone
CVE ID : CVE-2025-56534
A stored cross-site scripting (XSS) vulnerability in the custom authenticator driver of opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
<image src =q onerror=prompt(8)>
Upgrade to OpenNebula >=7.0.