Homarr, an open-source dashboard, contains a DOM-based Cross-Site Scripting vulnerability in the /auth/login page. The application mistakenly trusts the "callbackUrl" URL parameter, passing it directly to the redirect function. An attacker can craft a malicious link that, when accessed by an authenticated user, forces a client-side redirect and injects arbitrary JavaScript into the browser. This leads to credential theft, potential internal network pivoting, and the execution of unauthorized actions in the victim’s context. The weakness is classified as CWE‑601 (Open Redirect) and CWE‑87 (Insertion of Code with Unescaped Input).

The flaw affects homarr-labs' Homarr product versions prior to 1.57.0. Any deployment of Homarr running an earlier release and exposing the /auth/login endpoint is vulnerable.

The CVSS score of 8.8 indicates a high severity, while the very low EPSS score (<1%) suggests that exploitation is currently uncommon. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the victim to be authenticated and to click the crafted link. Once triggered, the attacker can run JavaScript in the user's browser, enabling a range of client-side attacks such as session hijacking or phishing.*