Homarr versions prior to 1.57.0 contain a DOM-based Cross-Site Scripting vulnerability that poses a significant risk of credential theft and unauthorized account access.

The application improperly neutralizes user-supplied input within the callbackUrl parameter on the /auth/login page, which is subsequently passed to client-side redirect functions. This vulnerability allows an unauthenticated attacker to execute malicious scripts in the context of an authenticated user's session.

Successful exploitation enables an attacker to perform actions on behalf of the victim, steal session credentials, or conduct internal network reconnaissance. With a CVSS score of 8.8, this vulnerability represents a high risk to organizational data integrity and platform security, as it facilitates the potential compromise of administrative accounts.

Immediate Action: Update the Homarr dashboard to version 1.57.0 or later to apply the necessary input validation fix.

Proactive Monitoring: Monitor web server logs for suspicious URL parameters containing encoded JavaScript or unauthorized redirect attempts originating from the login endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and sanitize URL parameters for script injection patterns, specifically targeting the callbackUrl field.

Public Exploit Available: No (exploit_available: unknown)

Given the potential for account takeover and the availability of proof-of-concept information, this vulnerability should be prioritized for immediate remediation. Administrators must verify that all instances of Homarr are updated to version 1.57.0 to eliminate the injection vector and protect user sessions from interception.