---
id: "CVE-2026-118129"
kind: "vulnerability"
aliases: ["CVE-2026-118129"]
title: "Chitchatter: postMessage config check lets attackers bypass authentication remotely"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["chitchatter", "other", "self-hosted", "web-app"]
not_affected_if: ["patched-build"]
published_at: "2026-10-28T00:17:11+00:00"
first_seen_at: "2026-10-28T00:29:54+00:00"
updated_at: "2026-10-28T00:31:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118129", "first_seen_at": "2026-10-28T00:29:54+00:00"}]
---

# Chitchatter: postMessage config check lets attackers bypass authentication remotely

Chitchatter's postMessage handler in src/Bootstrap.tsx accepts configuration messages from an improperly validated parentDomain argument, so authentication can be bypassed. A remote attacker can send forged configuration messages, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the deployed build includes commit `e3babb5cd83bfe3b99f1d82358ac5c1ea8e8a688` (for example, `git merge-base --is-ancestor e3babb5cd83bfe3b99f1d82358ac5c1ea8e8a688 HEAD` in the deployed checkout)
- Review `isConfigMessageEvent` in `src/Bootstrap.tsx` for the parentDomain check
- Check the deployed version against the upstream repository; the sources give no release version because the project uses rolling releases

## Fix

- Update Chitchatter to a build that includes commit `e3babb5cd83bfe3b99f1d82358ac5c1ea8e8a688` or later
- Redeploy the web app after the update, since it is a rolling release with no version number to pin

## Timeline

- 2026-10-28T00:29:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118129

## From the sources

A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument parentDomain results in improper authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The patch is named e3babb5cd83bfe3b99f1d82358ac5c1ea8e8a688. It is recommended to apply a patch to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_