Stored XSS Vulnerability in Concrete CMS 9.5.0 and Below

CVE-2026-8197

What is CVE-2026-8197?

Concrete CMS versions 9.5.0 and below are susceptible to a Stored Cross-Site Scripting (XSS) vulnerability through the OAuth integration name. This flaw arises because the OAuth authorize template allows admin-controlled integration names to be rendered using Concrete's t() translation helper. Due to improper handling of PHP string interpolation prior to executing t(), the integration name ends up being outputted as raw HTML, which can be exploited by a malicious admin to execute scripts in the context of another user’s session. This could potentially allow for interception of sensitive login information, posing significant security risks.

References