DOM-XSS on Central SSO Origin via Unvalidated `retryUrl` (WAF Bypass with `javascript:name`)

Summary

The error page of a central Single Sign-On origin ([REDACTED-SSO]) reads a retryUrl query parameter, stores it verbatim in the SPA's component state, and passes it — with no scheme validation — to window.location.replace() when the victim clicks the page's visible "Try again" call-to-action.

Supplying retryUrl=javascript:name causes the browser to evaluate window.name as JavaScript in the SSO origin. The edge WAF blocks naive javascript:alert(...) payloads, but javascript:name is a bare identifier that passes every rule — and the actual HTML payload is never sent through the WAF at all, because it's smuggled in via window.name, which is seeded by the attacker's anchor target attribute.

Result: arbitrary JavaScript execution on the SSO origin that federates many downstream properties (including online banking). The page's CSP sandbox omits allow-modals, so only dialog APIs (alert/confirm/prompt) are suppressed — DOM takeover, credentialed fetch/XHR, document.cookie (non-HttpOnly), localStorage/sessionStorage, and postMessage are all fully available.

• Class: DOM-based Cross-Site Scripting (client-side injection)
• Affected asset: [REDACTED-SSO] — central SSO / identity origin (primary)