An unauthenticated cross-site scripting vulnerability in OpenPanel allows remote attackers to execute arbitrary scripts and perform unauthorized credentialed requests.

The vulnerability exists in the unauthenticated GET /misc/favicon endpoint, which fails to properly sanitize input. An unauthenticated attacker can supply a URL to a malicious SVG file, triggering script execution in the context of the victim's browser on the API origin.

The ability to execute scripts on the API origin poses a significant risk to application integrity and user security. By leveraging this cross-site scripting flaw, attackers can perform same-origin credentialed requests, potentially leading to unauthorized actions on behalf of authenticated administrators or users. With a CVSS score of 8.2, this high-severity vulnerability warrants immediate attention to prevent data compromise and session hijacking.

Immediate Action: Upgrade OpenPanel to version 2.3.0 or later to apply the necessary security patches and input validation controls.

Proactive Monitoring: Review web access logs for suspicious GET requests to the /misc/favicon endpoint, specifically those containing external URLs or unusual query parameters.

Compensating Controls: Implement a Content Security Policy (CSP) that restricts script execution and prevents the loading of untrusted external SVG resources until the software can be updated.

Public Exploit Available: Unknown

This vulnerability represents a critical security gap in OpenPanel, as it allows unauthenticated actors to target authenticated sessions. Security teams must prioritize upgrading to version 2.3.0 immediately to neutralize the risk of script injection and potential unauthorized API access. Failure to patch this issue could facilitate full account takeover through malicious same-origin requests.