An authenticated attacker can inject malicious JavaScript into an Open XDMoD user profile. By abusing the password reset function, the attacker sends an email that contains a link to an HTML page. When a victim clicks that link, the page reflects the unsanitized payload and executes it in the victim’s browser. This can lead to credential theft and takeover of the victim’s Open XDMoD account.

All Open XDMoD deployments running a version earlier than 11.0.3 are affected. The vendor is ubccr, and the product is the Open XDMoD framework for HPC analytics.

The vulnerability has a CVSS score of 8.6, indicating high severity, and is not listed in CISA’s KEV catalog. EPSS data is not available, so the exploitation probability cannot be quantified, but the flaw allows a credentialed attacker to perform a reflected XSS attack with the potential for account takeover. No exploits have been reported in the wild. The patch was released on 2026-05-12 and addresses the unsanitized handling of user profile data in the password reset flow.