{"schema":"threatline.record/2","record":{"id":"CVE-2026-118129","aliases":[],"summary":"jeremyckahn Chitchatter PostMessage Bootstrap.tsx isConfigMessageEvent improper authentication","details":"A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument parentDomain results in improper authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The patch is named e3babb5cd83bfe3b99f1d82358ac5c1ea8e8a688. It is recommended to apply a patch to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.","categories":["Unclassified"],"product":"Chitchatter","vendor":"jeremyckahn","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-118129","source_modified_at":"2026-10-27T23:15:19.571Z","fetched_at":"2026-10-28T01:10:53.534015Z","product":"Chitchatter","vendor":"jeremyckahn","versions":[{"version":"f82538633813c854a81a8b2112a2f6ba17b39cbc","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T23:15:19.571Z","modified_at":"2026-10-27T23:15:19.571Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-118129","fetched_at":"2026-10-28T01:10:53.534015Z","source_modified_at":"2026-10-27T23:15:19.571Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://vuldb.com/vuln/427456","tags":["vdb-entry","technical-description"]},{"source":"CVE List","url":"https://vuldb.com/vuln/427456/cti","tags":["signature","permissions-required"]},{"source":"CVE List","url":"https://vuldb.com/cve/CVE-2026-118129","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://vuldb.com/submit/1015027","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://github.com/0xGenesi/CVE/blob/main/Chitchatter_SDK_postMessage_Identity_Key_Injection.md","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/jeremyckahn/chitchatter/pull/635","tags":["issue-tracking","patch"]},{"source":"CVE List","url":"https://github.com/jeremyckahn/chitchatter/commit/e3babb5cd83bfe3b99f1d82358ac5c1ea8e8a688","tags":["patch"]},{"source":"CVE List","url":"https://github.com/jeremyckahn/chitchatter/","tags":["product"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-27T23:15:19.571Z","content_hash":"a638180df9d121464e3164b9e472269301038b6900d6a7fa012def9fdb135a8f"}}