CVE-2026-3096

MediumCVSS 4.7/10Last modified Sep 18, 2026

Description

The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction between the two browser contexts when navigating to external destinations.

This vulnerability could allow an attacker to manipulate the original trusted application window after a user clicks a malicious external link. This manipulation can lead to users being redirected to phishing pages, enabling credential theft, or facilitating other unauthorized actions within the context of the trusted site.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-20 CWE-603

Affected software

No affected versions have been published.

Timeline

Published: Sep 10, 2026
Last modified: Sep 18, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-309609.4rssn is a scientific computing library for Rust, combining a high-performance symbolic computation engine with numerical methods support and CVE-2026-309614.3Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, the chunked upload completion CVE-2026-309626.5Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.6 and 8.6.19, t CVE-2026-309632.7Capsule is a multi-tenancy and policy-based framework for Kubernetes. To defend against namespace hijacking achieved through update/patch op CVE-2026-309645.4web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mecha CVE-2026-309659.1Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.8 and 8.6.21, a CVE-2026-3096610.0Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.7 and 8.6.20, P CVE-2026-309678.8Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.9. and 8.6.22, CVE-2026-309689.8Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. P CVE-2026-309699.1Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. P CVE-2026-309709.1Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. P CVE-2026-309718.8ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpola