CVE-2026-118129

A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument parentDomain results in improper authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The patch is named e3babb5cd83bfe3b99f1d82358ac5c1ea8e8a688. It is recommended to apply a patch to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

• CWE-287

• https://github.com/0xGenesi/CVE/blob/main/Chitchatter_SDK_postMessage_Identity_Key_Injection.md
• https://github.com/jeremyckahn/chitchatter/
• https://github.com/jeremyckahn/chitchatter/commit/e3babb5cd83bfe3b99f1d82358ac5c1ea8e8a688
• https://github.com/jeremyckahn/chitchatter/pull/635
• https://vuldb.com/cve/CVE-2026-118129
• https://vuldb.com/submit/1015027
• https://vuldb.com/vuln/427456
• https://vuldb.com/vuln/427456/cti

Published

Oct 28, 2026

Last Modified

Oct 28, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11810The UpdateHub firmware-update agent's probe handler (z_impl_…7.5
• CVE-2026-118100The BuddyForms WordPress plugin before 2.10.3 does not check…5.3
• CVE-2026-118101The BuddyForms WordPress plugin before 2.10.1 does not verif…5.3
• CVE-2026-11811The UpdateHub over-the-air update client's start_coap_client…3.7
• CVE-2026-11812The UpdateHub management subsystem (subsys/mgmt/updatehub/up…2.5
• CVE-2026-118128A vulnerability has been found in a2aproject a2a-js up to 1.…6.5
• CVE-2026-11813A potential improper permissions vulnerability was reported …7.8
• CVE-2026-118131GnuPG (version 2.5.21) for Windows contains a vulnerability …
• CVE-2026-118132NextChat version 2.16.1 contains a client‑side cross‑site sc…
• CVE-2026-11814A command injection vulnerability in the listed NETGEAR mode…6.8
• CVE-2026-11815An attacker who intercepts and tampers with traffic between …5.3
• CVE-2026-11816Keras versions prior to 3.14.0 are vulnerable to a path trav…8.1