CVE-2026-39039

Deferred Deferred - Pending Action

Authentication Token Exposure in BharatMLStack UI

Publication date: 2026-09-15

Last updated on: 2026-09-22

Assigner: MITRE

Description

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-22

Generated

2026-10-06

AI Q&A

2026-09-15

EPSS Evaluated

2026-10-04

NVD

CVE-2026-39039

EUVD

EUVD-2026-78941

Affected Vendors & Products

Vendor	Product	Version / Range
meesho	bharatmlstack	to 1.3.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

The vulnerability in BharatMLStack up to v1.3.0 involves Trufflebox UI storing sensitive data like JWT authentication tokens, full user objects, and session IDs in the browser's localStorage. This makes the data accessible to any JavaScript running on the page, increasing the risk of unauthorized access or theft.

Detection Guidance

Check browser localStorage for sensitive data like JWT tokens, user objects, or session IDs in Trufflebox UI. Use browser developer tools to inspect localStorage or run JavaScript console commands like localStorage.getItem('token') to retrieve stored values.

Impact Analysis

This vulnerability could allow attackers to steal authentication tokens, user session data, or other sensitive information if they can execute malicious JavaScript on the page. This may lead to unauthorized account access, data breaches, or further exploitation of the system.

Compliance Impact

Storing sensitive data like authentication tokens and user objects in localStorage may violate GDPR's data protection principles and HIPAA's security requirements for safeguarding protected health information. It increases the risk of unauthorized access, potentially leading to non-compliance with these regulations.

Mitigation Strategies

Disable localStorage for sensitive data storage in Trufflebox UI. Switch to secure alternatives like HTTP-only, secure cookies or sessionStorage with shorter expiration times. Review and update the application's authentication mechanism to avoid exposing tokens in client-side storage.

Hi! I’m here to help you understand CVE-2026-39039. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70