Submeter #756026: a466350665 Smart-SSO <=2.1.1 Incomplete Denylist to Cross-Site Scripting

### Introduction

[Smart-SSO](https://github.com/a466350665) is a lightweight, high-availability Single Sign-On (SSO) authentication and authorization center built on **SpringBoot** and **OAuth2** protocol with **RBAC** (Role-Based Access Control) permission design.

Stored XSS vulnerabilities allow attackers to permanently store malicious scripts on the target server. When other users visit the affected page, the malicious script is executed.

### Affected Versions

Smart-SSO 2.1.1 and earlier

• Fonte: ⚠️ https://www.notion.so/Smart-SSO-Stored-Cross-Site-Scripting-XSS-in-Role-Edit-Page-303ea92a3c4180f4beb9c119653ce51d
• Utilizador: din4 (UID 50867)
• Submissão: 11/02/2026 02h24 (há 8 meses)
• Moderação: 22/02/2026 09h16 (11 days later)
• Estado: Aceite
• Entrada VulDB: 347339 [a466350665 Smart-SSO até 2.1.1 Role Edit Page UserController.java save Script de Site Cruzado]
• Pontos: 17