CVE-2026-3106
Medium
Description
Blind Cross-Site Scripting (XSS) in Teampass, versions prior to 3.1.5.16, within the password manager login functionality in the 'contraseña' parameter of the login form 'redacted/index.php'. During failed authentication attempts, the application does not properly clean or encode the information entered by the user in the username field. As a result, arbitrary JavaScript code is automatically executed in the administrator's browser when viewing failed login entries, resulting in a blind XSS condition.
SeverityMedium
CVSS5.4
Exploit probability—
ProductTeampass
PublishedMar 31, 2026
First seenMar 31, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- teampass teampass3.1.5.24 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| teampass teampass | 3.1.5.16 ≤ v < 3.1.5.24 | 3.1.5.24 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.