CVE-2026-124498 Details

A reflected cross-site scripting vulnerability has been identified in Azeus Convene Board Management Portal version 7.0.2.7_3 p72. The issue arises in the file '/jsp/ge/dummy_launcher.jsp', where the 'REDIRECT_URL' parameter is manipulated, allowing for the injection of malicious scripts. This vulnerability can be exploited remotely and has been publicly disclosed. Additionally, an old password validation bypass vulnerability has been discovered, allowing for a complete account takeover by exploiting the XSS vulnerability in conjunction with the password bypass.

To address the XSS vulnerability, apply strict output encoding to the 'REDIRECT_URL' parameter before reflecting it into inline script context. Implement a server-side allowlist to restrict 'REDIRECT_URL' to relative paths, rejecting 'javascript:', 'data:', and external URLs. Remove 'unsafe-eval' and 'unsafe-inline' from the Content Security Policy. For the password bypass, remove the 'AUTO_CREATED' parameter from the password change endpoint or enforce old password validation regardless of its value. Ensure that no client-controllable parameter can disable critical server-side validation.