lukevella rally <4.8.0 Reset Password DOM-Based XSS via redirectTo (CVE-2026-6493)

Vulnerability Overview Vulnerability Name: lukevella rally up to 4.7.4 Reset Password reset-password-form.tsx redirectTo cross site scripting Vulnerability Description: An issue was discovered in , affecting the in the component . By manipulating the parameter, a cross-site scripting (XSS) attack can be triggered. This vulnerability is uniquely identified as . CVSS Score: 3.2 Current Exploitation Price: $0-$5k CTI Interest Score: 5.15- Impact Scope Affected Component: Impact Type: Cross-Site Scripting (XSS) Impact Level: Problematic Attack Method: Remote Attack Attack Difficulty: Easy Attacker Requirements: No authentication required User Interaction: User interaction required Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None Remediation Plan Recommended Upgrade Version: Upgrade Link: GitHub Additional Information Vulnerability Discovery Date: April 17, 2026 Vulnerability Update Date: April 17, 2026 Vulnerability Submitter: trebdj Vulnerability Source: GitHub Vulnerability References: - CVE: CVE-2026-6493 - GCVE: GCVE-2026-6493 - GCVE (ValDB): GCVE-100-358037 - EUVD: EUVD Exploit Code Exploit Code: No specific code provided, but mentions existence of a public proof-of-concept (PoC). Threat Intelligence Interest: Low Active Actors: None Active APT Groups: None Timeline April 17, 2026: Vulnerability disclosed April 17, 2026: ValDB entry created April 17, 2026: ValDB entry last updated Source Information Product: GitHub Recommendation: GitHub Status: Confirmed Confirmation: Confirmed Entry Information Creation Time: April 17, 2026 09:35 AM Update Time: April 17, 2026 07:51 PM Changers: April 17, 2026 09:35 AM (61), April 17, 2026 07:51 PM (1) Completer: None Submitter: trebdj Cache ID: 5:1D7:109 Submission Information Accepted: Yes Submission: #787342: lukevella rally 4.7.5 DOM-Based XSS, Open Redirect (by trebdj) Discussion Comments: No comments Language: English Advertisement Splunk App: Download link Footer Copyright: © 1997-2026 vuldb.com License: CC BY-NC-SA Show More: Yes Pool: USAz20.4.1

Goal Reached Thanks to every supporter — we hit 100%!

lukevella rally <4.8.0 Reset Password DOM-Based XSS via redirectTo (CVE-2026-6493)