CVE-2026-26266
📋 TL;DR
A stored cross-site scripting (XSS) vulnerability in AliasVault Web Client allows attackers to inject malicious JavaScript into emails sent to any AliasVault email alias. When victims view these emails in the web client, the script executes with full application privileges, potentially compromising user accounts and sensitive data. All users of AliasVault Web Client versions 0.25.3 and lower are affected.
💻 Affected Systems
- AliasVault Web Client
📦 What is this software?
Aliasvault by Aliasvault
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover, theft of all stored passwords and email aliases, unauthorized access to connected services, and potential lateral movement within the application.
Likely Case
Session hijacking, credential theft, unauthorized access to password vaults, and compromise of email aliases.
If Mitigated
Limited impact with proper network segmentation and monitoring, though XSS could still lead to session theft if exploited.
🎯 Exploit Status
Attack requires sending crafted email to victim's alias, but no authentication needed for exploitation once email is viewed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.26.0
Vendor Advisory: https://github.com/aliasvault/aliasvault/security/advisories/GHSA-f65p-p65r-g53q
Restart Required: Yes
Instructions:
1. Backup current configuration and data. 2. Update AliasVault Web Client to version 0.26.0 or higher. 3. Restart the web client service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Disable Email Rendering
allTemporarily disable HTML email rendering in the web client to prevent XSS execution.
Configure web client to display emails as plain text only
Network Isolation
allRestrict access to the web client interface to trusted networks only.
Configure firewall rules to limit web client access
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Deploy web application firewall (WAF) with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Check web client version in admin interface or configuration files. If version is 0.25.3 or lower, system is vulnerable.Check Version:
Check web client configuration or admin panel for version informationVerify Fix Applied:
Verify web client version is 0.26.0 or higher and test email rendering with known XSS payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual email viewing patterns
- Multiple failed login attempts after email access
- JavaScript errors in application logs
Network Indicators:
- Suspicious email attachments or HTML content
- Unusual outbound connections from web client
SIEM Query:
search 'email_view' AND 'javascript_error' OR 'iframe_srcdoc' in application logs