Vulnerability record · CVE-2026-26861 · published 27 February 2026

CVE-2026-26861: Clevertap web sdk origin validation error vulnerability

Clevertap · Clevertap Web Sdk

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS) via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validation using the includes() method, which can be bypassed by an attacker using a subdomain

8.3 CVSS 3.1 High EPSS 0.22% · top 88.2% CWE-346 · Origin validation error

8.3CVSS 3.1 base score

0.22%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

3References, 1 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Clevertap Web Sdk Clevertap

References

Link	Tags
https://github.com/CleverTap/clevertap-web-sdk/blob/cf1b65d/src/util/campaignRender/nativeDisplay.js#L118-L121	Product
https://github.com/CleverTap/clevertap-web-sdk/issues/424	ExploitIssue TrackingVendor Advisory
https://github.com/CleverTap/clevertap-web-sdk/pull/417	Patch

Track CVE-2026-26861 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.3CVE-2026-26862Clevertap web sdk cross-site scripting vulnerabilityCleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual Builder modul…EPSS 0.53%27 Feb 2026 9.4CVE-2025-34291Langflow CORS misconfiguration leads to token theft and RCELangflow up to and including 1.6.9 ships an overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) and a refresh token …KEVEPSS 93%analysed5 Dec 2025 8.8CVE-2015-4495Firefox PDF reader same-origin bypass allows file read and privilege gainThe PDF reader in Mozilla Firefox (before 39.0.3), Firefox ESR 38.x (before 38.1.1), and Firefox OS (before 2.2) fails to properly validate origin, l…KEVEPSS 69%analysed8 Aug 2015

Source: NIST National Vulnerability Database (record CVE-2026-26861), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.