Navigation Allowlist Bypass in EdgeEver Desktop by Tianma-If
CVE-2026-109559

8.4HIGH

Key Information:

Vendor: Tianma-if
Status: Edgeever
Vendor: CVE Published:; 12 October 2026

What is CVE-2026-109559?

EdgeEver Desktop versions 1.6.26 through 1.112.0 are vulnerable to a navigation allowlist bypass. This flaw allows attackers to bypass restrictions on the loading of allowed sources by using string-prefix URL matching. By embedding links that utilize userinfo syntax after the 'dev-server' prefix, malicious actors can gain unauthorized access to sensitive components, such as session tokens and remote procedure call (RPC) channels, potentially compromising user data and application security. Timely updates are essential to mitigate this risk.

Affected Version(s)

EdgeEver 1.6.26 <= 1.112.0

References

https://github.com/tianma-if/edgeever/issues/536

issue-tracking

https://github.com/tianma-if/edgeever/issues/546

issue-tracking

https://github.com/tianma-if/edgeever/commit/6b5027e8b4be...

patch

CVSS V4

Score:

8.4

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

Unknown

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 12, 2026
Vulnerability Reserved
Oct 12, 2026

Credit

wgetnz

CVE-2026-109559 Data

JSON