CVE-2026-11425 Domoticz CVE debrief

Who should care

Administrators and users of Domoticz versions prior to 2026.3 should be aware of this vulnerability and take necessary precautions to prevent exploitation. This includes reviewing and updating Text or Alert subtype device values, monitoring for suspicious activity, and applying vendor remediation when available. Security teams should prioritize patching and compensating controls for exposed systems while remediation is scheduled and verified. Vulnerability management processes should include tracking exceptions, retesting remediated assets, and closing the item only after evidence is documented. Operators of Domoticz deployments should verify their versions and plan for upgrades or mitigations through normal change control where exposure is confirmed. Platform administrators should check relevant monitoring, detection, and logs for exposed assets that need extra review. Asset inventory processes should account for Domoticz deployments and their exposure status. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified. They should also track exceptions, retest remediated assets, and close the item only after evidence is documented. Operators should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Vulnerability management processes should include planning vendor-supported updates or mitigations through normal change control where exposure is confirmed. Security teams should prioritize patching and compensating controls for exposed systems while remediation is scheduled and verified. They should also review compensating controls for exposed systems while remediation is scheduled and verified. Asset inventory processes should account for Domoticz deployments and their exposure status. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified. They should also track exceptions, retest remediated assets, and close the item only after evidence is documented. Operators should

Technical summary

The CVE-2026-11425 vulnerability affects Domoticz versions prior to 2026.3, allowing authenticated attackers to inject arbitrary HTML and JavaScript by updating Text or Alert subtype device values through the API. The mobile dashboard renders device data via ng-bind-html with only an nl2br() transform that performs no HTML escaping, enabling session cookie theft and account takeover. This vulnerability could be exploited by attackers to gain unauthorized access to the system, potentially leading to account takeover and other malicious activities. The vulnerability is particularly concerning due to the ease of exploitation and the potential impact on Domoticz deployments.

Defensive priority

Authenticated attackers could inject HTML and JavaScript via the mobile dashboard, enabling session cookie theft and account takeover.

Recommended defensive actions

• Inventory and verify Domoticz versions, checking for versions prior to 2026.3
• Implement compensating controls, such as Web Application Firewalls (WAFs) or Intrusion Detection Systems (IDS)
• Monitor for suspicious activity, particularly injections of malicious payloads
• Apply vendor remediation when available, upgrading to Domoticz version 2026.3 or later
• Restrict API access to update Text or Alert subtype device values

Evidence notes

The CVE description indicates Domoticz versions prior to 2026.3 contain a stored cross-site scripting vulnerability in the mobile dashboard. The mobile dashboard renders device data via ng-bind-html with only an nl2br() transform that performs no HTML escaping. This allows attackers to store malicious payloads that execute in any administrator's browser upon viewing the mobile dashboard, enabling session cookie theft and account takeover. Evidence is limited to the CVE description and NVD details, which may not cover all affected deployments or variations.

Official resources