CVE-2026-67595

Name of the Vulnerable Software and Affected Versions VaahCMS versions 2.0.0 through 2.3.4

Description A malicious obfuscated JavaScript payload is embedded in the Blade template used for rendering security OTP emails. This allows remote attackers to execute unauthorized code in browsers that render the email template with JavaScript enabled. The payload establishes a WebSocket connection to a hardcoded command-and-control endpoint, utilizes MutationObserver to install a password-field keylogger for capturing dynamically added inputs, scrapes WhatsApp Web DOM content, and accepts remote commands to redirect or overwrite the rendered page.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.