SSRF Vulnerability in Chrome Devtools Protocol APIs Affecting User Authentication
CVE-2026-87897

4.6MEDIUM

Key Information:

Vendor

Nextcloud
Status
Whiteboard
Vendor
CVE Published:
27 October 2026

What is CVE-2026-87897?

A SSRF vulnerability has been identified that allows attackers to gain unauthorized access to internal Chrome Devtools Protocol APIs. This can lead to the leakage of JWT authentication tokens for other users. By initiating a recording, a low privileged attacker can exploit this weakness repeatedly, thereby acquiring read and write permissions on the victim's Whiteboard. This exposure poses a significant risk to user data and security, making it critical for users to be aware of and address this vulnerability promptly.

Affected Version(s)

whiteboard 1.0.0

References

https://hackerone.com/reports/3576823

CVSS V3.0

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

alex-elttam (alex-elttam)
.