CVE-2026-6493

CVE

Threat entity extracted from intelligence sources

Frequency

2

occurrences

First Seen

April 17, 2026

Last Seen

April 18, 2026

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

CVE-2026-6493: XSS Vulnerability in lukevella rallly Affects Password Reset Functionality45.9

A cross-site scripting (XSS) vulnerability, identified as CVE-2026-6493, has been discovered in lukevella rallly versions up to 4.7.4. The flaw resides in the Reset Password Handler component, specifically in the reset-password-form.tsx file, where the redirectTo parameter can be manipulated. This v...

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (1)

CVE-2026-6493: XSS Vulnerability in lukevella rallly Affects Password Reset Functionality

Apr 18·1 sources

Related Articles (2)

CVE-2026-6493: lukevella rallly Reset Password reset-password-form.tsx cross site scripting [LOW] CVSS 3.5 Exploit Intelligence — Recent CVEs / 23h A flaw has been found in lukevella rallly up to 4.7.4. This affects an unknown function of the file apps/web/src/app/[locale]/(auth)/reset-password/components/reset-password-form.tsx of the component Reset Password Handler. Executing a manipulation of the argument redirectTo can lead to cross site s

exploit-intel.com·Apr 18

CVE-2026-6493 - Exploits & Severity

Related Entities

Cross-site Scripting CWE-79 - Cross-site Scripting (xss)Lukevella Rallly XSS