Authentication secrets and session data exposed through logs and client storage

NO FIX YET

Credentials, OAuth secrets, session information and other authentication artifacts are written to application logs and persistent client-side storage. An attacker who can read those logs or storage can take over sessions and access accounts.

first public Nov 9, 2026 · 1 source

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

No product ranges from the sources yet.

02 · How to check

Unknown from the sources.

03 · The fix

No fix yet, per the sources.

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 9, 2026

What the sources say, verbatim

262 characters

Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through application logs and persistent client-side storage, enabling unauthorized access and session compromise.

Sources and references

NVD: CVE-2026-118798Nov 9, 2026

This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.

Are you affected?

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check