CVE-2026-33510

CVE-2026-33510 is a DOM-based Cross-Site Scripting vulnerability affecting Homarr, an open-source dashboard application, in versions prior to 1.57.0. The flaw exists in the /auth/login page, where the application improperly trusts the callbackUrl URL parameter, which is then passed to redirect and router.push functions without adequate sanitization. This allows attackers to craft malicious links that, when clicked by authenticated users, execute arbitrary JavaScript code in their browser context. The vulnerability carries a CVSS score of 8.8 (HIGH) with a network-based attack vector requiring no special privileges and minimal user interaction. The attack complexity is low, and the impact is significant, including high confidentiality impact (credential theft), low integrity impact (unauthorized actions), and low availability impact. The ability to execute JavaScript within the victim's browser session could facilitate credential theft, internal network reconnaissance and pivoting, and unauthorized actions performed on behalf of the compromised user. There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hot lists. The EPSS score of 0.00048 indicates minimal probability of exploitation relative to other CVEs. Organizations should prioritize upgrading to version 1.57.0 or later to remediate this vulnerability before it gains wider attention.