Read the docs
TI-2026-83323 Aliases CVE-2026-7004GHSA-q9pw-h7cq-jxq7

WIT SynApps Runtime reflected XSS via LINK parameter

Priority MEDIUM 56CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting flaw (CWE-79). An unauthenticated attacker can inject and run arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Exploitation allows credential harvesting, manipulation of the login flow, access to browser-visible data, and same-origin requests to controller endpoints, including an origin-switch primitive against the internal controller in Cloud RIA scenarios. CVSS 4.0 scores it 5.1 (MEDIUM); CISA SSVC rates exploitation as PoC, not automatable, with partial technical impact, the flaw is not in KEV, and the references include an exploit link.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Description from the CNA

WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Attackers can exploit this flaw to harvest credentials, manipulate the login flow, access browser-visible data, and perform same-origin requests to controller endpoints, including an origin-switch primitive against the internal controller in Cloud RIA scenarios.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00268 19th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WITSynApps Runtimeup to 1.4.11—No fix listedCNA
  • SynApps Runtime VendorWIT Affected up to 1.4.11 Fixed in — No fix listed CNA

Remediation

No fix is listed for WIT SynApps Runtime through 1.4.11.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-7004
  2. 2026-10-30 Alias added: GHSA-q9pw-h7cq-jxq7
  3. 2026-10-30 CISA SSVC decision points changed
  4. 2026-10-30 Priority changed: LOW → MEDIUM

References

Exploit 1

  • TI-2026-83322 WIT SynApps Runtime exposes hardcoded OAuth client credentials CVSS 4.0MEDIUM 6.9
  • TI-2026-83324 Browser-mediated SSRF in WIT SynApps Runtime controller onboarding CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences