HCL Hive Telco Observability is affected by  a Required directives missing from the CSP .

HCL Hive Telco Observability has incomplete security rules (Content Security Policy) in its Keycloak login component, which can allow attackers to inject malicious code into web pages.

The Keycloak component lacks required CSP directives, enabling content injection attacks. An attacker can exploit this to execute arbitrary JavaScript in users' browsers if the application processes untrusted input without proper directive enforcement.