漏洞关键信息 基本信息 类型: Cross-site scripting (XSS) 位置: OAuth Device Authorization screen 漏洞编号: GHSA-6cw9-5gg4-rhpj CVE: CVE-2026-21618 影响 严重性: High (8.5/10) CVSS v4 base metrics - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: None - Privileges Required: None - User interaction: Active - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None 描述 A XSS vulnerability exists on the OAuth Device Authorization / verification screen. An attacker can initiate an OAuth Device Authorization flow with crafted parameters that are later reflected into the device verification page without proper output encoding, causing arbitrary JavaScript to execute in the victim's browser. 影响范围 受影响版本: >= 617e44c71f1dd9043870205f371d375c5c4d886d 修复版本: c692438684ead90c3bcbfb9ccf4e63c768c668a8 修复 修复提交: c692438 引入漏洞的变更 变更: #1323