{"id":"CVE-2026-118129","title":"jeremyckahn Chitchatter PostMessage Bootstrap.tsx isConfigMessageEvent improper authentication","summary":"A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","cvssSource":"cna","cwe":["CWE-287"],"vendor":"jeremyckahn","product":"Chitchatter","affected":["Chitchatter f82538633813c854a81a8b2112a2f6ba17b39cbc"],"published":"2026-10-27","updated":"2026-10-27","sourceUpdated":"2026-10-27T23:15:19.571Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118129","references":[{"url":"https://vuldb.com/vuln/427456","label":"VDB-427456 | jeremyckahn Chitchatter PostMessage Bootstrap.tsx isConfigMessageEvent improper authentication"},{"url":"https://vuldb.com/vuln/427456/cti","label":"VDB-427456 | CTI Indicators (IOB, IOC, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-118129","label":"CVE-2026-118129 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/1015027","label":"Submit #1015027 | jeremyckahn Chitchatter develop branch @ 23b62a8 (source) authentication bypass / identity takeover"},{"url":"https://github.com/0xGenesi/CVE/blob/main/Chitchatter_SDK_postMessage_Identity_Key_Injection.md"},{"url":"https://github.com/jeremyckahn/chitchatter/pull/635"},{"url":"https://github.com/jeremyckahn/chitchatter/commit/e3babb5cd83bfe3b99f1d82358ac5c1ea8e8a688"},{"url":"https://github.com/jeremyckahn/chitchatter/"}],"tags":["cve.org"],"ingestedAt":"2026-10-27T23:59:48.418Z","slug":"CVE-2026-118129","body":"## Overview\n\nA vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument parentDomain results in improper authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The patch is named e3babb5cd83bfe3b99f1d82358ac5c1ea8e8a688. It is recommended to apply a patch to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.\n\n## Affected\n\n- `Chitchatter f82538633813c854a81a8b2112a2f6ba17b39cbc`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}