{"id":"CVE-2026-118129","aliases":[],"title":"jeremyckahn Chitchatter PostMessage Bootstrap.tsx isConfigMessageEvent improper authentication","titleSource":"VulDB","descriptionSource":"VulDB","products":[{"vendor":"jeremyckahn","name":"Chitchatter","platforms":[],"versions":[{"version":"f82538633813c854a81a8b2112a2f6ba17b39cbc","status":"affected"}],"source":"VulDB","url":"https://www.cve.org/CVERecord?id=CVE-2026-118129"}],"remediation":[],"description":"A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument parentDomain results in improper authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The patch is named e3babb5cd83bfe3b99f1d82358ac5c1ea8e8a688. It is recommended to apply a patch to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.","severity":"medium","score":5.3,"published":"2026-10-27T23:15:19.571Z","modified":"2026-10-27T23:15:19.571Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://vuldb.com/vuln/427456","https://vuldb.com/vuln/427456/cti","https://vuldb.com/cve/CVE-2026-118129","https://vuldb.com/submit/1015027","https://github.com/0xGenesi/CVE/blob/main/Chitchatter_SDK_postMessage_Identity_Key_Injection.md","https://github.com/jeremyckahn/chitchatter/pull/635","https://github.com/jeremyckahn/chitchatter/commit/e3babb5cd83bfe3b99f1d82358ac5c1ea8e8a688","https://github.com/jeremyckahn/chitchatter/"],"sources":[{"name":"CVE","id":"CVE-2026-118129","modified":"2026-10-27T23:15:19.571Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118129"}],"assessments":[{"source":"VulDB","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","score":5.3},{"source":"VulDB","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","score":6.3},{"source":"VulDB","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","score":6.3},{"source":"VulDB","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C","score":7.5}],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T21:40:30.742Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}