PT-2026-104806
CVE-2026-59788
·
Published
2026-10-05
·
Updated
2026-10-05
Description by
CVSS 4.0
5.6
MediumMetricsAV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
The product name cannot be determined (affected versions not specified)
Description
The email media type OAuth form fails to validate the URL scheme of the Authorization endpoint value before passing it to the
window.open() function. This allows the execution of a javascript: URL in the browser. An attacker can deliver a crafted media type configuration via an import file to execute arbitrary JavaScript in the context of the Super Admin who grants consent. This is a Stored Cross-Site Scripting (XSS) issue, where a malicious script is permanently stored on the server and executed when a user views the affected page.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾