{"id":"CVE-2026-87897","kind":"vulnerability","aliases":["CVE-2026-87897"],"related":[],"title":"Whiteboard app: SSRF leaks another user's JWT token via Chrome DevTools","description":"A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when they start a recording, which then enables the attacker read/write access to the victim's Whiteboard.","summary":"A server-side request forgery flaw lets a low-privileged user reach internal Chrome DevTools Protocol APIs. An attacker can capture another user's JWT authentication token when that user starts a recording, then read and write that user's Whiteboard.","severity":"medium","cvss":4.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chrome-devtools-protocol","jwt","other","whiteboard"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-27T17:17:03+00:00","first_seen_at":"2026-10-27T17:32:47+00:00","triaged_at":"2026-10-27T17:34:55+00:00","updated_at":"2026-10-27T17:34:55+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-27T17:34:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Whiteboard app: SSRF leaks another user's JWT token via Chrome DevTools","impact":"high","summary":"A server-side request forgery flaw lets a low-privileged user reach internal Chrome DevTools Protocol APIs. An attacker can capture another user's JWT authentication token when that user starts a recording, then read and write that user's Whiteboard.","category":"other","nicknames":[],"who_cares":["whiteboard","chrome-devtools-protocol","jwt"],"confidence":0.4,"needs_auth":"yes","worst_case":"attacker takes over victim's Whiteboard via leaked JWT token","analyst_note":"Identify the affected Whiteboard product and vendor, and the fixed version, from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-87897 and the vendor advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000531,"input_tokens":3336,"output_tokens":395,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-87897':15A,18A 'access':75C,121C 'anoth':5A,49B,90C,108C 'api':44B,81C 'app':2A 'attack':46B,95C,119C 'authent':53B,87C,105C 'captur':48B 'chrome':11A,20B,41B,78C 'chrome-devtools-protocol':19B 'continu':97C 'could':96C 'cve':13A,16A 'devtool':12A,21B,42B,79C 'enabl':74C,117C 'exploit':98C 'flaw':32B 'forgeri':31B 'found':72C 'intern':40B,77C 'jwt':8A,23B,52B,86C,104C 'leak':4A,84C,102C 'let':33B 'low':36B,93C 'low-privileg':35B 'privileg':37B,94C 'protocol':22B,43B,80C 'reach':39B 'read':62B 'read/write':120C 'record':60B,114C 'request':30B 'server':28B 'server-sid':27B 'side':29B 'ssrf':3A,70C 'start':58B,112C 'token':9A,54B,88C,106C 'user':6A,38B,50B,57B,66B,91C,109C 'via':10A 'victim':124C 'vulner':71C,100C 'whiteboard':1A,25B,68B,126C 'write':64B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87897","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87897","severity":null,"published_at":"2026-10-27T17:17:03+00:00","modified_at":"2026-10-27T17:17:03+00:00","first_seen_at":"2026-10-27T17:32:47+00:00","fetched_at":"2026-10-27T17:32:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}