CVE-2026-59788

MediumCVSS 5.7/10Last modified Oct 6, 2026

Description

The email media type OAuth form passes the Authorization endpoint value to window.open() without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who grants consent.

Metrics

CVSS 4.0 5.7/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 5, 2026
Last modified: Oct 6, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-59798.8A vulnerability was detected in D-Link DIR-605L 2.13B01. Affected by this vulnerability is the function formVirtualServ of the file /goform/CVE-2026-597913.5In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible CVE-2026-597929.8In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible CVE-2026-597938.8In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration CVE-2026-597945.4In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data CVE-2026-597956.1In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible CVE-2026-597968.1In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks CVE-2026-597979.8Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affec CVE-2026-597998.8Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authen CVE-2026-59808.8A flaw has been found in D-Link DIR-605L 2.13B01. Affected by this issue is the function formSetMACFilter of the file /goform/formSetMACFilt CVE-2026-598009.89Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (thi CVE-2026-598019.89Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider manag