The vulnerability allows an attacker to inject malicious script content via the callbackURL parameter in the Onboarding Endpoint component. This leads to a reflected cross‑site scripting condition, enabling an attacker to run arbitrary JavaScript in the victim's browser. The effect could compromise session data or perform phishing attacks, as the script runs with the privileges of the current user. The issue is identified as a classic reflected XSS (CWE‑79) and also involves unsanitized code injection (CWE‑94).

The affected product is openstatusHQ openstatus, all releases prior to the patched commit 43d9b2b9ef8ae1a98f9bdc8a9f86d6a3dfaa2dfb are vulnerable. Because the project follows a rolling‑release model, a specific version list is not provided; any instance running the code before that commit may be susceptible. The vulnerability resides in the client.tsx file of the onboarding endpoint, an unknown function within the dashboard sub‑module.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by tailoring the callbackURL argument, likely via a crafted URL or form submission. Mitigation requires applying the vendor patch or removing the vulnerable code path.