PT-2026-29212 · Teampass · Teampass

Published 2026-03-31 · Updated 2026-05-20 · CVE-2026-3106

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Teampass versions prior to 3.1.5.16

Description The application does not properly clean or encode user-provided information during failed authentication attempts. Specifically, the contraseña parameter within the login form at ‘redacted/index.php’ is susceptible to improper handling. This allows for the execution of arbitrary JavaScript code in the administrator's browser when viewing failed login entries, resulting in a blind Cross-Site Scripting (XSS) condition.

Recommendations Update Teampass to version 3.1.5.16 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-3106

Affected Products

Teampass

References · 4

• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-teampass · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-3106 · Security Note
• https://twitter.com/malware_owl/status/2057124674916819197 · Twitter Post
• https://twitter.com/CVEnew/status/2038916011186168198 · Twitter Post