Apache Roller 6.1.5 contains a reflected cross‑site scripting flaw in the optional LDAP comment authenticator. The component writes unsanitized request parameters back into its HTML form, permitting a malicious actor to inject arbitrary script when a victim follows a crafted URL. This results in client‑side code execution and could lead to credential theft or defacement.

The flaw exists only in installations that enable the LdapCommentAuthenticator in Roller 6.1.5. Any user who has already accessed the authenticator form is vulnerable when presented with a specially forged link. Roller 6.1.6 and newer versions escape the reflected data, eliminating the risk.

The CVSS base score of 6.1 reflects a moderate severity; the lack of an EPSS score and no KEV listing suggest limited current exploitation. Attackers can exploit the vulnerability over the web with no authentication, though the victim must be authenticated to the site and have previously loaded the form. Mitigation relies on applying the available patch or disabling the vulnerable authenticator.