CVE-2026-50980 in oPanel
Summary
by MITRE • 08/28/2026
Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The identified vulnerability represents a classic Cross-Site Scripting flaw located within the Domain Name System management interface of the oPanel software, specifically affecting versions prior to 1.20.25. This security defect arises from insufficient input validation and sanitization mechanisms when processing DNS TXT records retrieved or displayed by the application. In this architecture, the web server acts as an intermediary that fetches specific DNS information and renders it directly into the HTML response without properly encoding special characters such as angle brackets, quotes, or ampersands. This failure to implement proper output encoding allows malicious actors to inject executable client-side scripts into the page content served to legitimate users. The vulnerability is particularly insidious because it leverages a trusted domain context; since the script executes within the security context of the oPanel application, browsers will not block the execution due to same-origin policy restrictions, thereby granting the attacker full access to the privileges associated with that session.
From an operational perspective, this flaw enables remote attackers to perform arbitrary JavaScript injection through crafted DNS TXT records. An adversary can configure a domain under their control and set its TXT record to contain malicious script payloads. When an administrator or authorized user of oPanel views the details of such a domain within the management console, the application retrieves the TXT record and displays it in the browser without sanitization. Consequently, the injected JavaScript executes immediately upon page load. This capability allows for session hijacking, where the attacker can steal sensitive cookies containing authentication tokens or session identifiers. With these credentials, the attacker can impersonate the victim user, gaining unauthorized access to administrative functions, potentially leading to complete compromise of the hosting environment and associated services managed by oPanel.
This vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as a Cross-Site Scripting weakness. The attack vector is categorized under ATT&CK technique T1059.007, specifically JavaScript execution on the client side, and falls within the broader category of Client-side Injection attacks. The exploitation chain relies heavily on social engineering or prior compromise to influence DNS configurations, but once triggered, it provides a direct path to credential theft and session manipulation without requiring user interaction beyond viewing the affected page in a browser.
Mitigation strategies must focus on both immediate patching and long-term defensive coding practices. The primary remediation is to upgrade oPanel to version 1.20.25 or later, where this specific input validation flaw has been addressed by developers implementing robust sanitization routines for DNS data before rendering it in the user interface. In addition to upgrading software, administrators should implement Content Security Policy headers that restrict script execution sources and prevent inline scripts from running unless explicitly allowed through nonces or hashes. Furthermore, adopting a defense-in-depth approach includes ensuring that all dynamic content is properly encoded using context-aware encoding techniques such as HTML entity encoding for data inserted into HTML bodies. Regular security audits of third-party components and continuous monitoring of DNS configurations can also help detect anomalous TXT record changes that may indicate attempted exploitation attempts.