---
id: CVE-2026-118129
title: >-
  jeremyckahn Chitchatter PostMessage Bootstrap.tsx isConfigMessageEvent
  improper authentication
summary: >-
  A vulnerability was found in jeremyckahn Chitchatter up to
  f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function
  isConfigMessageEvent of the file src/Bootstrap.tsx of the component
  PostMessage Handler. Performing…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-287
vendor: jeremyckahn
product: Chitchatter
affected:
  - Chitchatter f82538633813c854a81a8b2112a2f6ba17b39cbc
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T23:15:19.571Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118129'
references:
  - url: 'https://vuldb.com/vuln/427456'
    label: >-
      VDB-427456 | jeremyckahn Chitchatter PostMessage Bootstrap.tsx
      isConfigMessageEvent improper authentication
  - url: 'https://vuldb.com/vuln/427456/cti'
    label: 'VDB-427456 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-118129'
    label: CVE-2026-118129 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1015027'
    label: >-
      Submit #1015027 | jeremyckahn Chitchatter develop branch @ 23b62a8
      (source) authentication bypass / identity takeover
  - url: >-
      https://github.com/0xGenesi/CVE/blob/main/Chitchatter_SDK_postMessage_Identity_Key_Injection.md
  - url: 'https://github.com/jeremyckahn/chitchatter/pull/635'
  - url: >-
      https://github.com/jeremyckahn/chitchatter/commit/e3babb5cd83bfe3b99f1d82358ac5c1ea8e8a688
  - url: 'https://github.com/jeremyckahn/chitchatter/'
tags:
  - cve.org
ingestedAt: '2026-10-27T23:59:48.418Z'
---

## Overview

A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument parentDomain results in improper authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The patch is named e3babb5cd83bfe3b99f1d82358ac5c1ea8e8a688. It is recommended to apply a patch to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

## Affected

- `Chitchatter f82538633813c854a81a8b2112a2f6ba17b39cbc`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.