Which versions of PHP are affected by CVE-2026-3106?

Teampass password manager versions before 3.1.5.16 contain a critical blind cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious code into failed login logs,…. A patch is available.

How to fix or mitigate CVE-2026-3106?

Within 24 hours: Inventory all Teampass deployments and confirm current versions. Within 7 days: Upgrade all instances to Teampass 3.1.5.16 or later. Within 30 days: Audit failed login logs for suspicious username patterns, review administrator session logs for unauthorized activity, and reset credentials for any accounts with administrative access to the Teampass system.

PHP CVE-2026-3106

Q: What is the CVSS score of CVE-2026-3106?

CVE-2026-3106 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-17345 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-03-31 INCIBE

XSS PHP

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 31, 2026 - 09:15 euvd

EUVD-2026-17345

Analysis Generated

Mar 31, 2026 - 09:15 vuln.today

Patch released

Mar 31, 2026 - 09:15 nvd

Patch available

CVE Published

Mar 31, 2026 - 08:51 nvd

CRITICAL 9.3

DescriptionCVE.org

Blind Cross-Site Scripting (XSS) in Teampass, versions prior to 3.1.5.16, within the password manager login functionality in the 'contraseña' parameter of the login form 'redacted/index.php'. During failed authentication attempts, the application does not properly clean or encode the information entered by the user in the username field. As a result, arbitrary JavaScript code is automatically executed in the administrator's browser when viewing failed login entries, resulting in a blind XSS condition.

AnalysisAI

Blind Cross-Site Scripting in Teampass password manager versions prior to 3.1.5.16 allows unauthenticated remote attackers to execute arbitrary JavaScript in administrator browsers via malicious username input during failed login attempts. The vulnerability achieves high confidentiality and integrity impact (CVSS 9.3) because malicious code is stored and automatically executed when administrators review failed authentication logs, enabling potential session hijacking, credential theft, or administrative account compromise. No active exploitation confirmed via CISA KEV, though the attack requires no authentication and minimal complexity.

Technical ContextAI

Teampass is an open-source collaborative password manager built on PHP and MySQL. This vulnerability stems from improper input validation and output encoding (CWE-79) in the authentication handler at index.php. When processing failed login attempts, the application accepts arbitrary input in the 'contraseña' (password) parameter and username field without sanitization, then renders this unsanitized data in the administrative interface where login failure logs are displayed. The blind XSS nature means the payload executes in a different user context (administrator) than where it was injected (login form), making it particularly dangerous as administrators routinely review authentication logs for security monitoring. The affected CPE (cpe:2.3:a:teampass:teampass) indicates all Teampass installations below version 3.1.5.16 are vulnerable regardless of deployment configuration.

RemediationAI

Immediately upgrade Teampass to version 3.1.5.16 or later, which addresses this vulnerability along with other security issues identified by INCIBE. Download the patched version from the official Teampass repository and follow standard upgrade procedures including database backup prior to migration. Review administrator session logs and browser history for indicators of exploitation, particularly unexpected JavaScript execution or unauthorized administrative actions following authentication failure log reviews. If immediate patching is not feasible, implement Web Application Firewall rules to filter script tags and JavaScript event handlers from login form parameters, though this is an imperfect workaround. Restrict administrative interface access to trusted IP ranges and implement Content Security Policy headers to limit inline script execution. Complete advisory with additional vulnerability details available at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-teampass.