Ajenti through version 2.2.13 suffers from a clickjacking weakness in the browser-facing login and administrative UI. The server fails to emit anti-framing headers such as X-Frame-Options or a Content-Security-Policy frame-ancestors directive, enabling an attacker to embed an invisible or transparent frame on a malicious page. This trick users into revealing credentials or executing privileged actions, threatening the confidentiality and integrity of the target system, though it does not allow remote code execution on the server.

version 2.2.13 or older is affected. All deployments that use the default web UI bundled with ajenti-core are impacted due to the missing frame-control headers.

Exploitation requires a victim to visit a crafted page that frames the Ajenti UI; thus the likely attack vector is purely browser-based and does not require penetration into the network or server. The CVSS score of 5.4 classifies the issue as medium severity, and the EPSS score of < 1 % indicates that exploitation is unlikely. The vulnerability is not listed in CISA’s KEV database. The joint weakness is CWE-1021, a client-side attack without server-side privilege escalation.