CVE-2026-59802

CVE-2026-59802 is a high-severity vulnerability with a CVSS 3.x base score of 8.2. The underlying weakness is classified as CWE-183.

Key facts

Description

PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient validation in the valid_url function. Attackers can create malicious pushes containing data:text/html URIs that execute arbitrary JavaScript in victims' browsers when clicked, enabling phishing and credential theft under the trusted PasswordPusher domain.

Frequently asked questions

What is CVE-2026-59802?
PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient validation in the valid_url function. Attackers can create malicious pushes containing data:text/html URIs that execute arbitrary JavaScript in victims' browsers when clicked, enabling phishing and credential theft under the trusted PasswordPusher domain.
How severe is CVE-2026-59802?
CVE-2026-59802 has a CVSS 3.x base score of 8.2, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity low, and availability none.
Is CVE-2026-59802 being actively exploited?
It is not currently listed in CISA's Known Exploited Vulnerabilities catalog, and no EPSS exploit-prediction score is available yet.
How do I fix CVE-2026-59802?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-59802 published?
CVE-2026-59802 was published on 2026-07-08.

References

Other CWE-183 vulnerabilities

Browse all CWE-183 vulnerabilities →