# Verint Verba XSS via login logs

Published: 2026-05-14 · Severity: medium
Canonical: https://vorant.io/reports/58c21037-ca5c-5fb8-b0a1-6547c903812a/verint-verba-xss-via-login-logs

> Stored XSS in Verint Verba's login logging lets unauthenticated attackers execute code in admin browsers viewing logs; fixed in 10.0.6.

CERT Polska coordinated disclosure of CVE-2026-21730, a stored cross-site scripting vulnerability in Verint Verba software. The flaw exists in the login logging mechanism where unauthenticated attackers can inject malicious XSS payloads via the username field during failed login attempts. Due to lack of input sanitization, these payloads are stored in application logs and execute when administrators view the logs through the web interface.

The vulnerability requires no authentication to exploit and chains user interaction (an admin viewing logs) with code execution in the admin's browser context. While the attack surface is limited to administrators who access the log viewer, successful exploitation could lead to session hijacking, credential theft, or further administrative actions performed under the admin's privileges.

Verint released version 10.0.6 to address this issue. The vulnerability was responsibly disclosed by Jan Czerlunczakiewicz from STM Cyber through CERT Polska's coordinated vulnerability disclosure process.

## Mentioned in this report

- Vulnerabilities: CVE-2026-21730

## Detection guidance (public sample)

### Possible Stored XSS Payload in Login Username Field (Verint Verba CVE-2026-21730)

ATT&CK: T1059.007

Detects HTTP login requests where the username parameter contains script/event-handler markers indicative of stored XSS injection attempts targeting login log viewers, as seen in CVE-2026-21730 affecting Verint Verba. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Possible Stored XSS Payload in Login Username Field
id: a95e04ad-5143-58b7-8516-b94131a138f2
status: experimental
description: 'Detects unauthenticated login attempts where the username field contains
  HTML/JavaScript

  injection markers (script tags, event handlers, javascript: URIs). This matches
  the exploitation

  pattern of CVE-2026-21730, a stored XSS in Verint Verba''s login logging mechanism
  where

  attacker-controlled usernames are later rendered unsanitized in the admin log viewer.

  '
references:
- CERT Polska coordinated disclosure of CVE-2026-21730
author: Vorant
tags:
- attack.t1059.007
- attack.initial-access
- attack.t1189
logsource:
  category: webserver
detection:
  selection_field:
    cs-uri-query|contains:
    - username=
    - user=
    - login=
  selection_payload:
    cs-uri-query|contains:
    - <script
    - onerror=
    - onload=
    - onmouseover=
    - 'javascript:'
    - '%3Cscript'
    - String.fromCharCode
  selection_body:
    c-uri-stem|contains:
    - /login
    - /auth
    - /signin
  condition: selection_field and selection_payload and selection_body
falsepositives:
- Security scanners or authorized penetration tests probing login forms for XSS
- Automated vulnerability assessment tools testing input sanitization
level: high
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-21730

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/58c21037-ca5c-5fb8-b0a1-6547c903812a/verint-verba-xss-via-login-logs.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup