A stored cross‑site scripting flaw exists in the pre‑login notice that is rendered on the legacy login page. The notice is saved as raw HTML and no input sanitisation is performed. A user who can modify system settings can inject arbitrary JavaScript via the PUT /api/preloginnotice endpoint, which will run in the browser of anyone who visits the login page. The attack can lead to theft of session tokens, cookie hijacking, or arbitrary actions performed within the context of the logged‑in user. Because the script runs in the context of the login page, it can also deface the interface or trick users into submitting credentials to a phishing domain.

This issue affects the openEQUELLA platform published by the Apereo Foundation. All installations running a version prior to 2026.2 are vulnerable. The problem is tied to the legacy logon route that remains available before the vendor recommends disabling it in newer releases.

The vulnerability carries a CVSS score of 4.8, indicating a medium severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog, suggesting no active exploit has been reported yet. The flaw can be exploited by a user with EDIT_SYSTEM_SETTINGS permission; if this permission is granted to a default guest or Everyone account, then unauthenticated or low‑privilege users can trigger the XSS. Attackers would need to target the legacy logon page, which is reachable by default in existing installations.