Verint Verba XSS via login logs
Stored XSS in Verint Verba's login logging lets unauthenticated attackers execute code in admin browsers viewing logs; fixed in 10.0.6.
CERT Polska coordinated disclosure of CVE-2026-21730, a stored cross-site scripting vulnerability in Verint Verba software. The flaw exists in the login logging mechanism where unauthenticated attackers can inject malicious XSS payloads via the username field during failed login attempts. Due to lack of input sanitization, these payloads are stored in application logs and execute when administrators view the logs through the web interface.
The vulnerability requires no authentication to exploit and chains user interaction (an admin viewing logs) with code execution in the admin's browser context. While the attack surface is limited to administrators who access the log viewer, successful exploitation could lead to session hijacking, credential theft, or further administrative actions performed under the admin's privileges.
Verint released version 10.0.6 to address this issue. The vulnerability was responsibly disclosed by Jan Czerlunczakiewicz from STM Cyber through CERT Polska's coordinated vulnerability disclosure process.
Mentioned in this report
Detection guidance
Possible Stored XSS Payload in Login Username Field (Verint Verba CVE-2026-21730)
Detects HTTP login requests where the username parameter contains script/event-handler markers indicative of stored XSS injection attempts targeting login log viewers, as seen in CVE-2026-21730 affecting Verint Verba. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Possible Stored XSS Payload in Login Username Field
id: a95e04ad-5143-58b7-8516-b94131a138f2
status: experimental
description: 'Detects unauthenticated login attempts where the username field contains
HTML/JavaScript
injection markers (script tags, event handlers, javascript: URIs). This matches
the exploitation
pattern of CVE-2026-21730, a stored XSS in Verint Verba''s login logging mechanism
where
attacker-controlled usernames are later rendered unsanitized in the admin log viewer.
'
references:
- CERT Polska coordinated disclosure of CVE-2026-21730
author: Vorant
tags:
- attack.t1059.007
- attack.initial-access
- attack.t1189
logsource:
category: webserver
detection:
selection_field:
cs-uri-query|contains:
- username=
- user=
- login=
selection_payload:
cs-uri-query|contains:
- <script
- onerror=
- onload=
- onmouseover=
- 'javascript:'
- '%3Cscript'
- String.fromCharCode
selection_body:
c-uri-stem|contains:
- /login
- /auth
- /signin
condition: selection_field and selection_payload and selection_body
falsepositives:
- Security scanners or authorized penetration tests probing login forms for XSS
- Automated vulnerability assessment tools testing input sanitization
level: high
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-21730
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free