CVE-2026-3107
Stored XSS in Teampass Password Import Enables Credential Theft
Publication date: 2026-03-31
Last updated on: 2026-04-07
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| teampass | teampass | From 3.1.5.16 (inc) to 3.1.5.24 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Stored Cross-Site Scripting (XSS) issue found in Teampass versions prior to 3.1.5.16. It occurs in the password import functionality at a specific endpoint. The application does not properly sanitize or encode user input during the import process, allowing malicious JavaScript code to be stored persistently in the database.
When other users view the imported passwords, the malicious script executes automatically in their browsers. This stored XSS enables attackers to run arbitrary JavaScript in the context of multiple users and administrators.
How can this vulnerability impact me? :
Exploiting this vulnerability can lead to serious security impacts including session hijacking, credential theft, privilege abuse, and compromise of the application's integrity.
- Attackers can execute arbitrary JavaScript code in users' browsers.
- Attackers may steal user credentials or hijack sessions.
- Attackers can abuse privileges and compromise the application.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows attackers to execute arbitrary JavaScript code in the context of multiple users and administrators, potentially leading to session hijacking, credential theft, privilege abuse, and compromise of application integrity.
Such security breaches can result in unauthorized access to sensitive data, which may violate data protection requirements under regulations like GDPR and HIPAA that mandate the protection of personal and health information.
Therefore, this vulnerability could negatively impact compliance with these standards by exposing sensitive user credentials and compromising the confidentiality and integrity of stored data.