---
id: CVE-2020-1055
title: >-
  A cross-site-scripting (XSS) vulnerability exists when Active Directory
  Federation Services (ADFS) does not properly sanitize user inputs
summary: >-
  A cross-site-scripting (XSS) vulnerability exists when Active Directory
  Federation Services (ADFS) does not properly sanitize user inputs. An
  un-authenticated attacker could exploit the vulnerability by sending a
  specially crafted reques…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-79
  - CWE-79
vendor: microsoft
product: windows_10
affected:
  - windows_10 = 1809
  - windows_10 = 1903
  - windows_10 = 1909
  - windows_server_2016 = 1903
  - windows_server_2016 = 1909
  - windows_server_2019
published: '2020-05-21'
updated: '2026-08-19'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-1055'
references:
  - url: 'https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1055'
    label: secure@microsoft.com
  - url: >-
      https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1055
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.0239
epssPercentile: 0.83241
ingestedAt: '2026-08-19T17:42:36.482Z'
---

## Overview

A cross-site-scripting (XSS) vulnerability exists when Active Directory Federation Services (ADFS) does not properly sanitize user inputs. An un-authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected ADFS server.
The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run scripts in the security context of the current user.
This security update addresses the vulnerability by ensuring that ADFS properly sanitizes user inputs.

## Affected

- `windows_10 = 1809`
- `windows_10 = 1903`
- `windows_10 = 1909`
- `windows_server_2016 = 1903`
- `windows_server_2016 = 1909`
- `windows_server_2019`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.