CVE-2025-6024

VULNERABILITY OVERVIEW CVE-2025-6024 is a stored or reflected cross-site scripting (XSS) vulnerability in an authentication endpoint that fails to properly encode user-supplied input before rendering it in web pages. The vulnerability allows attackers to inject malicious scripts that execute in users' browsers, potentially redirecting users to malicious sites, manipulating page UI, or exfiltrating sensitive browser information. Session hijacking is not possible due to httpOnly cookie protections. SEVERITY ASSESSMENT The vulnerability carries a CVSS 3.1 score of 6.1 (Medium) with a network-based attack vector requiring no authentication and low attack complexity. However, the attack requires user interaction, limiting its impact scope. The vulnerability presents low confidentiality and integrity risks but poses no availability impact. The FAUCET Risk Score of 34.0/100 reflects a moderate threat level. EXPLOITATION STATUS There is no evidence of active exploitation, as CVE-2025-6024 is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and appears inactive on security hotlists. EPSS scoring indicates this vulnerability is exploited less frequently than the vast majority of disclosed CVEs. No publicly available exploit code has been reported, though the straightforward nature of XSS vulnerabilities suggests proof-of-concept development would be relatively simple.