LinkAce, a self‑hosted link collection platform, has a stored cross‑site scripting vulnerability that is triggered through an OAuth display name. A low‑privilege user can set a malicious script as their OAuth display name and then generate an API token, which causes the payload to be written into the audit log. When any administrator visits the audit log page, the script executes inside the admin’s browser context, allowing the attacker to steal session cookies, exfiltrate CSRF tokens, or perform any other action that the administrator can perform.

The flaw affects all installations of Kovah LinkAce prior to version 2.5.6 that are configured to use SSO/OAuth authentication. Versions 2.5.6 and later include the necessary patch. Administrators of older deployments are at risk until they upgrade or otherwise mitigate the issue.

The CVSS score of 8.5 indicates a high severity. EPSS data is not available and the vulnerability is not listed in CISA's KEV catalogue, but the attack remains feasible because it requires only that an attacker have an OAuth account, which is typically available to any user. The exploitation path is straightforward: set a malicious display name, create an API token, and wait for an administrator to view the audit logs. The payload runs in the admin’s browser context, providing complete control over that session.