The vulnerability allows an attacker to embed a javascript: URL into the analytics collection endpoint, which is later rendered as an anchor link in the Top Pages dashboard. Because the endpoint performs no scheme validation, a crafted hostname together with a special pathname can be stored and then presented to authenticated users. Clicking the poisoned link can hijack the user session and give the attacker full control of the Fathom Lite account.

Fathom Lite version 1.3.1 and earlier, installed by the usefathom organization, remains vulnerable. The flaw resides in the /collect endpoint and is not limited to any specific deployment architecture.

The CVSS score of 5.1 classifies the problem as medium severity. The EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. Nonetheless, the attack path is straightforward: unauthenticated requests to /collect can inject payloads that are later displayed to logged‑in users. Because the stored JavaScript executes in the context of the authenticated session, a successful attack leads to session hijacking or complete account takeover. The risk therefore depends on the presence of exposed /collect endpoints and the value of the compromised accounts.