CVE-2026-3107

CVE-2026-3107 identifies a critical Stored Cross-Site Scripting (XSS) vulnerability in Teampass versions prior to 3.1.5.16. This flaw allows an attacker to inject malicious JavaScript payloads during the password import process due to improper input sanitization, which are then persistently stored and executed in other users' browsers when viewing imported passwords. Rated 9.3 CRITICAL, the vulnerability has a network attack vector and low attack complexity, requiring no user interaction, and can lead to session hijacking, credential theft, privilege abuse, and compromise of application integrity. While there is no evidence of active exploitation or public exploit code available, the vulnerability was recently published and has garnered minimal community discussion.