7.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-8197

CVE-2026-8197: Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name

Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name. The OAuth authorize template renders the integration name (admin-controlled) through Concrete's t() translation helper as a sprintf-style format. The <strong>...</strong> wrap is built by PHP string interpolation before t() runs, so the integration name lands in the translated output as raw HTML. A rogue admin could potentially snoop on login submissions.The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Thanks Yonatan Drori (Tenzai) for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-8197

CVE-2026-8197:

7.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
concrete5/concrete5	composer	< 9.5.1	9.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2026-8197, is a stored XSS issue in Concrete CMS's OAuth authorization process. The provided patch f22b9dff59454391a50a255a39995bf635deea9e contains the fix. The core of the vulnerability lies in the concrete/views/oauth/authorize.php template file. The patch shows that the integration name, retrieved via $integration->getName(), was previously passed directly into the t() translation function as part of a formatted string containing HTML tags. The fix involves wrapping $integration->getName() with the h() function, which is Concrete CMS's helper for HTML escaping, thus neutralizing the XSS vector.

The vulnerable function is the one responsible for rendering this view. While the controller file itself is not part of the provided patch, the patch does include changes to concrete/src/Authentication/Type/OAuth/ServiceProvider.php. This service provider sets up the routes for the OAuth functionality, and it explicitly maps the oauth2/authorization/consent route to the Concrete\Core\Authentication\Type\OAuth\Api\Authorization::consent method. This provides strong evidence that Authorization::consent is the controller method that prepares the data and renders the vulnerable authorize.php view. Therefore, this function is identified as the entry point for the vulnerability in a runtime profile.

Vulnerable functions

Concrete\Core\Authentication\Type\OAuth\Api\Authorization::consent

concrete/src/Authentication/Type/OAuth/Api/Authorization.php

The `consent` method in the `Concrete\Core\Authentication\Type\OAuth\Api\Authorization` controller is responsible for rendering the OAuth authorization consent page. This method passes the OAuth integration object to the `concrete/views/oauth/authorize.php` view. Before the patch, this view used the integration's name directly within a translation string that contained HTML, without proper escaping. This allowed for a stored Cross-Site Scripting (XSS) vulnerability. An administrator could create an OAuth integration with a malicious name containing JavaScript. When a user attempts to authorize this malicious application, the script would execute in the context of the user's browser, potentially leading to session hijacking or other attacks.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.