The vulnerability in the Migration‑Planner UI App allows an attacker to register a discovery agent that uses a credentialUrl containing malicious JavaScript. When an organizational user clicks that link in the interface, the script runs in the user's browser context. Because the script executes with the privileges of the logged‑in user, it can hijack the Red Hat Single Sign‑On (SSO) session, leading to unauthorized access across tenants and the ability to perform privileged API actions. This is a stored Cross‑Site Scripting (CWE‑79) flaw.

This flaw affects the Migration‑Planner UI App component. Specific version ranges are not listed in the advisory; users should verify if their deployment includes the issue and update to a fixed release once available.

The CVSS score of 7.3 indicates high severity, and while the EPSS score is not available, the flaw requires user interaction—the victim must click the link—to trigger the exploit. The attack can be performed by any attacker who can register a malicious discovery agent, meaning internal users or compromised accounts could pose a threat. Because the code runs in the victim’s browser session, it can steal SSO tokens and perform cross‑tenant data or API actions. The vulnerability is not listed in the CISA KEV catalog.