CVE-2024-49754: LibreNMS API token field stored XSS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

medium priorityStored XSS requires authentication and victim interaction, but the high EPSS score and public exploit reference raise the practical risk for exposed LibreNMS instances.

What it is

LibreNMS before 24.10.0 stores unsanitized input from the API token parameter on the API-Access page, allowing authenticated users to inject JavaScript that runs in other users' sessions. Because the payload persists and executes for anyone viewing the affected page, it can compromise accounts of higher-privileged users.

Impact

An attacker with a low-privileged account can run arbitrary JavaScript in the browser of any user who views the API-Access page, potentially stealing session data or performing actions as that user.

Attack surface

Reached over the network through the web interface by an authenticated user who creates an API token with a crafted token value; the victim must view the affected page, so user interaction is required.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.71, 99th percentile) and a vendor advisory is tagged as an exploit reference, indicating public proof-of-concept or exploit detail exists.

What to do

• Upgrade LibreNMS to 24.10.0 or later, which contains the fix.
• If immediate upgrade is not possible, restrict access to the API-Access page to trusted administrators.
• Review and remove any suspicious existing API tokens with unexpected characters.
• Apply output encoding or input validation to the token parameter as a temporary compensating control.

Detection

• Search web server and application logs for API token creation requests containing script tags or event handlers in the token parameter.
• Audit existing API tokens for values containing HTML or JavaScript syntax.
• Monitor for anomalous authenticated sessions or actions originating from users who recently viewed the API-Access page.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.