CVE-2026-91922: Steedos Steedos-Platform

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaApi or data parameters to execute arbitrary JavaScript in victim sessions and steal X-Auth-Token credentials.

Affected products

• Steedos Steedos-Platform: up to and including 3.0.15-beta.47

Published 2026-09-15. Last modified 2026-09-24.