CVE-2026-3107 Multiple vulnerabilities in Teampass
Stored XSS in Teampass allows attackers to execute arbitrary JavaScript via password imports, leading to session hijacking and credential theft.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-3107?
CVE-2026-3107 is a critical cross-site scripting vulnerability in Teampass Teampass, published on 31 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Stored Cross-Site Scripting (XSS) in Teampass versions prior to 3.1.5.16, affecting the password manager's password import functionality at the endpoint 'redacted/index.php?page=items'. The application fails to properly sanitize and encode user-input data during the import process, allowing malicious JavaScript payloads to be persistently stored in the database. When other users view the imported passwords, the payload is automatically executed in their browsers, resulting in a stored XSS condition at the endpoint 'redacted/index.php?page=items'. Exploiting this vulnerability allows an attacker to execute arbitrary JavaScript code in the context of multiple users and the administrator, which can lead to session hijacking, credential theft, privilege abuse, and compromise of application integrity.
Weakness: CWE-79
Which versions are affected by CVE-2026-3107?
It affects 1 product.
Products include Teampass Teampass.
How do I fix CVE-2026-3107?
No fix has been published for CVE-2026-3107 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-3107 being exploited?
There is no known exploitation of CVE-2026-3107 in the wild and no public exploit code.
Other vulnerabilities in Teampass Teampass
Sources
Also known as GHSA-65q8-p76v-6qj6.