The CVSS 7.3 rating for this stored XSS on the Jet Admin sign-in page is misleading. This isn't a contained injection — it's a platform-level trust inversion where the authentication page itself becomes a persistent credential harvesting mechanism.
The vulnerability lives in the 'scripts and styles' customization feature that allows administrators to inject content into the sign-in page. An attacker with admin access plants a payload once, and it executes passively in every subsequent visitor's browser — including users who haven't created an account yet. The sign-in page is the first point of contact for new users, who are maximally trusting because they have no context for the application's behavior. No phishing, no social engineering, no active lure required.
The real danger is the blast radius. Harvested credentials belong to users with active sessions inside the platform. If the same customization feature exists post-authentication, an attacker can pivot from the sign-in page to every page those users can access — a fan-out cascade, not linear escalation. Each new customer tenant adds more potential victims to the harvest pool; the attack surface grows as the platform succeeds, not diminishes.
Detection is the structural gap. Security tooling focuses on runtime application behavior and API monitoring. Sign-in pages are treated as infrastructure — static content, pre-authentication, not worth DOM monitoring. Most security programs aren't watching login page state, which makes this payload unusually difficult to detect.
On remediation: this isn't a reflected XSS with a closing attack window. It's a planted payload that compounds in value each day it remains unpatched. Every day of remediation lag is a day of credential accumulation, session positioning, and potential password reuse exploitation against other systems. Prioritize this as persistent infrastructure compromise, not a discrete vulnerability event.