CVE-2026-82808
Received Received - Intake

Hard-Coded Credentials in Inbox Foundry ActiveInbox Extension

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulDB

Description
A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was informed beforehand about the issue. The support explains, that "[a]t the moment, the [bug bounty] programme is on hold while we work through a large number of existing reports."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82808
EUVD
EUVD-2026-68655

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
inbox_foundry activeinbox_extension to 7.10.24 (inc)
the_inbox_foundry_limited activeinbox 7.10.24
google oauth_client *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-798 The product contains hard-coded credentials, such as a password or cryptographic key.
CWE-259 The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a hardcoded Google OAuth client secret in The Inbox Foundry Limited's ActiveInbox Chrome extension version 7.10.24. The secret is embedded in the file dist/service-worker.production-esm.js and used in OAuth token exchanges. Since Chrome extension bundles are publicly accessible, the secret can be extracted by anyone, enabling unauthorized use or impersonation of the OAuth client identity.

Detection Guidance

Check if the ActiveInbox Chrome extension version 7.10.24 is installed. Inspect the extension bundle by navigating to the Chrome extensions directory and examining the file dist/service-worker.production-esm.js for the presence of unsafe_client_secret or client_secret fields.

Impact Analysis

Attackers could extract the hardcoded OAuth client secret and use it to impersonate the application, gaining unauthorized access to user accounts or performing actions on behalf of the application. This could lead to data breaches, account takeovers, or misuse of OAuth tokens.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and secure authentication, such as GDPR's principles of data protection by design and HIPAA's safeguards for protected health information. Exposure of OAuth secrets undermines secure authentication and could lead to unauthorized data access.

Mitigation Strategies

Remove the ActiveInbox extension version 7.10.24 immediately. Rotate the exposed Google OAuth client secret. Contact the vendor for an updated version or alternative solutions. Consider migrating to a more secure OAuth flow like Authorization Code with PKCE.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82808. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart