CVE-2026-119407
Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthe
CVSS
7.1
Alta
EPSS
0.1%
p4
KEV
—
Exploit Today
1
0-100
Publicado: 30 de out. de 2026 · Última mod.: 4 de nov. de 2026 · CWE-352
0.1%EPSS · 30 dias0.1%
2026-10-312026-11-07
Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guest_user_id and guest_access_token to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys.
- abraxaslabs.techhttps://abraxaslabs.tech/research/element-fragment-guest
- github.comhttps://github.com/element-hq/element-web
- github.comhttps://github.com/element-hq/element-web/blob/v1.12.31/apps/web/src/Lifecycle.ts#L188
- github.comhttps://github.com/element-hq/element-web/commit/792453c88a399d570599f5d73b08b40157cd80c0
- github.comhttps://github.com/element-hq/element-web/releases/tag/v1.12.32
- github.comhttps://github.com/element-hq/element-web/security/advisories/GHSA-c88w-7h6p-27xr
- www.vulncheck.comhttps://www.vulncheck.com/advisories/element-web-and-element-desktop-before-1.12.32-forced-logout-via-guest-credential-url-parameters
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1235457.1 ALT—
———OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows attackers to approve device codes when consent is skipped for implied-consent clients. Attackers can start a device authorization and lure a logged-in user to a crafted page, obtaining access and ID tokens to call APIs as that user.7hCVE-2026-1234954.6 MÉD—
———Vikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the /api/v2 login and OIDC callback endpoints without CSRF or Origin checks, enabling login cross-site request forgery. An attacker with an account can lure a victim to a page posting the attacker's credentials or OIDC code, switching the victim into the attacker's account and exposing data the victim then adds.7hCVE-2026-1234943.5 BAI—
———Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data into a victim's account because the Todoist, Microsoft To Do, and Trello migration OAuth callbacks lack a bound state parameter. Attackers can authorize their own account, keep the unused callback code or token, and lure a logged-in victim to the migration callback route to auto-import attacker-chosen projects and tasks containing phishing links.7hCVE-2026-1217836.5 MÉD—
——0Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmer Peter WP Data Access wp-data-access allows Cross Site Request Forgery.This issue affects WP Data Access: from n/a through 5.5.90.14hCVE-2026-1217628.8 ALT10.0%
——3Cross-Site Request Forgery (CSRF) vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Podcasting: from n/a through 11.18.0.14hCVE-2026-1194846.3 MÉD1.9%
——1Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Photo Gallery by Supsystic gallery-by-supsystic allows Cross Site Request Forgery.This issue affects Photo Gallery by Supsystic: from n/a through 1.21.6.14h