PT-2026-29212 · Teampass · Teampass

CVE-2026-3106 · Publicado 2026-03-31 · Atualizado 2026-05-20

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Teampass versions prior to 3.1.5.16

Description The application does not properly clean or encode user-provided information during failed authentication attempts. Specifically, the contraseña parameter within the login form at ‘redacted/index.php’ is susceptible to improper handling. This allows for the execution of arbitrary JavaScript code in the administrator's browser when viewing failed login entries, resulting in a blind Cross-Site Scripting (XSS) condition.

Recommendations Update Teampass to version 3.1.5.16 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-3106

Produtos afetados

Teampass

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3106.json · Exploit
• https://twitter.com/CVEnew/status/2038916011186168198 · Publicação no Twitter
• https://twitter.com/malware_owl/status/2057124674916819197 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-3106 · Nota de Segurança
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-teampass · Correção
• https://osv.dev/vulnerability/CVE-2026-3106 · Aviso do Fabricante