Back exploit-intel.com

CVE-2026-6493: lukevella rallly Reset Password reset-password-form.tsx cross site scripting [LOW] CVSS 3.5 Exploit Intelligence — Recent CVEs / 23h A flaw has been found in lukevella rallly up to 4.7.4. This affects an unknown function of the file apps/web/src/app/[locale]/(auth)/reset-password/components/reset-password-form.tsx of the component Reset Password Handler. Executing a manipulation of the argument redirectTo can lead to cross site s

exploit-intel.com • April 18, 2026

A flaw has been found in lukevella rallly up to 4.7.4. This affects an unknown function of the file apps/web/src/app/[locale]/(auth)/reset-password/components/reset-password-form.tsx of the component Reset Password Handler. Executing a manipulation of the argument redirectTo can lead to cross site scripting. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 4.8.0 mitigates this issue. Upgrading the affected component is advised. The vendor was contacted early this disclosure.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-6493: XSS Vulnerability in lukevella rallly Affects Password Reset Functionality A cross-site scripting (XSS) vulnerability, identified as CVE-2026-6493, has been discovered in lukevella rallly versions up to 4.7.4. The flaw resides in the Reset Password Handler component, specifically in the reset-password-form.tsx file, where the redirectTo parameter can be manipulated. This vulnerability allows authenticated attackers with low privileges to execute reflected XSS attacks, potentially compromising user data integrity. Although no public proof-of-concept exploits or active exploitation have been reported, the threat remains significant due to the availability of a published exploit. A patch has been released in version 4.8.0, and users are urged to upgrade immediately. Interim measures include implementing Content Security Policy (CSP) headers and monitoring authentication logs for suspicious activities. The CVSS score for this vulnerability is 5.1, indicating a moderate severity level. Organizations using affected versions should prioritize patching to mitigate risks. 1 sources 46

Extracted Entities

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)