Agate vulnerable to HTML injection in user signup - Administrator phishing risk
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Agate is central authentication server software for OBiBa epidemiology applications. Prior to version 3.3.0, when registering for an Agate account, arbitrary HTML code can be injected into a user's first and last name. This HTML is then rendered in the email sent to administrative users. The Agate service account sends this email and appears trustworthy, making this a significant risk for phishing attacks. Administrative users are impacted, as they can be targeted by unauthenticated users. Version 3.3.0 fixes the issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA agate (obiba) Fixed in 3.3.0
Timeline
- 2026-10-02 Threatist record created from CVE-2025-27102
References
More obiba vulnerabilities
- TI-2025-20571 Opal vulnerable to CSRF protection bypass CVSS 4.0HIGH 7.7
- TI-2025-19971 Broken Access Control in Opal filesystem's copy functionality exposes all user data CVSS 4.0HIGH 7.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences