CVE-2026-31381

CVE-2026-31381 is an information disclosure vulnerability affecting Gainsight Assist, allowing an attacker to extract user email addresses (PII). This occurs due to email addresses being exposed in base64 encoding within the 'state' parameter of the OAuth callback URL. Rated with a CVSS score of 5.3 (MEDIUM), it presents a low complexity network attack vector, primarily impacting confidentiality by revealing sensitive user data. There is no evidence of active exploitation, nor are public exploit modules or code available. However, the vulnerability has garnered some community discussion and media attention, with reports indicating it has been fixed.