CVE-2026-52873

Received Received - Intake

Stored XSS in Streambert Electron App via Wyzie API Key Redemption

Publication date: 2026-08-18

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until version 2.6.0, the wyzie-open-redeem IPC handler in index.js creates the partition:wyzie-redeem Electron session and registers an onHeadersReceived hook that removes the Content-Security-Policy header from every response in that session. The redeem window also lacks a setWindowOpenHandler restriction, so script injection in sub.wyzie.io, a loaded third-party resource, or a site reached through navigation executes without CSP constraints and can affect additional windows and persistent session storage. A user must open the Wyzie API key redemption window, and exploitation requires attacker-controlled script content in a loaded page. The resulting renderer script can invoke renderer-exposed application functionality and can be chained with other vulnerabilities to access internal services or sensitive data. This issue is fixed in version 2.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-21

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-52873

Affected Vendors & Products

Vendor	Product	Version / Range
streambert	streambert	to 2.6.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

This vulnerability affects Streambert, an Electron app for streaming and downloading videos. Between versions 2.5.0 and 2.6.0, the app's wyzie-open-redeem handler removes the Content-Security-Policy header from responses in a specific session. The redeem window also lacks restrictions, allowing script injection from third-party sites like sub.wyzie.io. This enables attackers to execute scripts without CSP constraints, potentially affecting other windows and session storage.

Detection Guidance

Check if Streambert version is between 2.5.0 and 2.6.0. Inspect Electron session settings for partition:wyzie-redeem and verify Content-Security-Policy headers are removed. Look for script injection attempts in sub.wyzie.io or loaded third-party resources.

Impact Analysis

An attacker could exploit this by tricking you into opening a malicious Wyzie API key redemption window. If successful, they can run scripts that access sensitive data, interact with other windows, or chain this with other vulnerabilities to access internal services or persistent storage.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing script injection that may access sensitive data. The lack of Content-Security-Policy (CSP) headers and unrestricted window handling could lead to unauthorized data exposure or manipulation, which are key concerns under these regulations.

Mitigation Strategies

Upgrade Streambert to version 2.6.0 or later to fix the issue. Disable the Wyzie API key redemption window if not needed. Restrict script execution in Electron sessions and enforce CSP headers.

Hi! I’m here to help you understand CVE-2026-52873. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70