EUVD-2026-112695
GHSA-6mhp-f693-q22x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessBrowse public foxit.com pages
-
ExploitRead credentials embedded in client-side JavaScript
-
ImpactAbuse exposed third-party authorization on external service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond accessing the public foxit.com website - the CVSS vector (PR:N/UI:N) indicates no authentication and no user interaction, and the credentials were exposed in client-side JavaScript readable by any visitor. The flaw is specific to the foxit.com web property (CPE cpe:2.3:a:foxit_software_inc.:foxit.com), not Foxit's PDF/reader products. Limiting factors: exploitation was only possible during the exposure window prior to the 2026-10-29 fix reported in EUVD; realistic impact is bounded by the privileges and scope of the specific third-party service the leaked credentials authorize, which is not disclosed; and because this is a single website rather than installable software, there is no multi-environment deployment to compromise. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6 High) describes a trivially exploitable, remote, unauthenticated, no-interaction confidentiality exposure with a scope change, which is internally consistent with the description: third-party authorization credentials were embedded in client-side JavaScript served by the foxit.com website, so any visitor could read them, and the scope change (S:C) reflects that the real impact lands on a separate third-party service rather than foxit.com itself. However, the raw 8.6 overstates sustained priority: no EPSS probability is provided, the CVE is NOT on CISA KEV, and no proof-of-concept or exploit reference is supplied (the only reference is Foxit's generic security-bulletins page). The vuln.today decision label is 'this_week' (not act_now/emergency), and the affected-version data ('foxit.com before 2026-10-29') together with today's date indicates the issue is already remediated on the live site. This is a single-website asset, not distributed software, so there is no fleet-wide exposure to patch - the genuine risk was the window during which the credentials were live and the downstream blast radius of whatever third-party service those credentials unlock, which is not quantified in the available data. Net: a legitimately severe information-exposure finding during its exposure window, but current ongoing risk is low given the reported fix, and key signals (EPSS, KEV, PoC, the identity/privilege of the leaked third-party credentials) are missing. |
| Exploit ScenarioDerived | An unauthenticated remote attacker loads pages on foxit.com, opens the client-side JavaScript bundles in browser dev tools, and extracts the hardcoded third-party authorization credentials (e.g., API keys or tokens). The attacker then replays those credentials directly against the associated third-party service to access or misuse it. No proof-of-concept or exploit code is referenced in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 29, 2026
Third-party authorization credentials were embedded directly in client-side JavaScript served by the Foxit website (foxit.com), letting any visitor read them without authentication or user interaction and potentially reuse them against the third-party service they authorize. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6 High) fits that exposure exactly, including the scope change that reflects impact landing on a separate third-party system rather than on foxit.com itself. EUVD records the affected range as foxit.com before 2026-10-29, and no public exploit code was identified at time of analysis; realistic risk depends on the privileges of the specific third-party service the leaked credentials grant, which has not been disclosed.
RemediationAI
There is no customer-side patch for this issue: the vulnerable component is Foxit's own hosted website, and the fix is vendor-side removal of the embedded credentials from the client-side JavaScript, with EUVD recording the affected range as ending 2026-10-29 and Foxit's security bulletins page (https://www.foxit.com/support/security-bulletins.html) as the reference; no separate patched version number is given in the available data. The essential compensating action, and the one with the most direct effect, is rotation or revocation of the exposed third-party authorization credentials so the leaked values no longer grant access - this invalidates any copy obtained during the exposure window but will break any integration still relying on the old secret until it is reconfigured. Alongside rotation, review the third-party service's access logs for the exposure window to detect use of the leaked credential from unexpected sources, and constrain the replacement credential's scope and lifetime (least-privilege permissions, short expiry, per-environment secrets) so a future leak has bounded impact. Architecturally, the durable fix is to move the secret behind a server-side proxy or token-exchange endpoint so the browser never receives the long-lived credential; note that content-security-policy or obfuscation changes would not have prevented this class of exposure, since the value was already delivered to the client. Users of Foxit's reader and editor products are not affected by this CVE and need no action.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-798 (Use of Hard-coded Credentials): secrets that belong in server-side configuration were instead shipped inside JavaScript delivered to every browser that loaded the foxit.com property. Because a web client bundle is fully readable by anyone who requests the page, there is no meaningful access control protecting such a value - the CVSS metrics PR:N and UI:N simply describe that the credential was readable by an unauthenticated visitor with no interaction, and AC:L reflects that no special attack condition was needed. The S:C scope change is the noteworthy element: the confidentiality impact (C:H) is scored against a component other than the vulnerable web property, i.e. the third-party service the leaked authorization information unlocks, while integrity and availability of foxit.com itself are unaffected (I:N/A:N). The supplied CPE, cpe:2.3:a:foxit_software_inc.:foxit.com, identifies the website itself, not Foxit's PDF readers, Editor, or PhantomPDF product lines, so this is a web-property secret-management failure rather than a memory-safety or parsing flaw in installable software. The trigger for the original leak - how the credential came to be committed into the client bundle - is not described in the available sources.
Know when Foxit Com gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Credentials readable from public website JavaScript require no auth or interaction (AV:N/AC:L/PR:N/UI:N); S:C and C:H because the leaked third-party credentials impact a separate service, with no integrity or availability effect.
Primary rating from Vendor (Foxit).
CVSS VectorVendor: Foxit
DescriptionCVE.org
A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains third-party authorization information. This may allow unauthorized parties to obtain or misuse the exposed credentials.
Executive ViewAI
Foxit inadvertently exposed third-party authorization credentials in client-side JavaScript on its public website, allowing any visitor to obtain them without authentication and potentially misuse them against an external service. The credentials are no longer served, but the window of exposure remains a concern for any organization whose data or operations depend on the affected third-party system. Leadership should prioritize confirmation of what the credentials can access, rotation of those secrets, and review of third-party access logs for unauthorized activity.
No vendor-released patch identified at time of analysis; interim mitigations include blocking access to the affected third-party service from untrusted networks, rotating any credentials that may have been exposed, monitoring that service's logs for unauthorized use, and requiring Foxit to confirm invalidation of the leaked credentials and removal of client-side secrets.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Server-side request forgery in Foxit's hosted HTML-to-PDF conversion service (foxit.com) lets remote, unauthenticated at
Foxit's hosted HTML-to-PDF conversion service used a shared token for submitted documents, so an unauthenticated remote
Exploit-DB