EUVD-2026-62197Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
AC:H because exploitation requires attacker control of content on a specific third-party domain; S:C because compromised renderer affects other windows and persistent storage; PR:N as no credentials are needed from the attacker side.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until version 2.6.0, the wyzie-open-redeem IPC handler in index.js creates the partition:wyzie-redeem Electron session and registers an onHeadersReceived hook that removes the Content-Security-Policy header from every response in that session. The redeem window also lacks a setWindowOpenHandler restriction, so script injection in sub.wyzie.io, a loaded third-party resource, or a site reached through navigation executes without CSP constraints and can affect additional windows and persistent session storage. A user must open the Wyzie API key redemption window, and exploitation requires attacker-controlled script content in a loaded page. The resulting renderer script can invoke renderer-exposed application functionality and can be chained with other vulnerabilities to access internal services or sensitive data. This issue is fixed in version 2.6.0.
AnalysisAI
Cross-site scripting via deliberate CSP header removal in Streambert's Electron API key redemption window affects versions 2.5.0 through 2.5.x, allowing attacker-controlled script content on sub.wyzie.io or any navigated resource to execute without Content-Security-Policy constraints and interact with other windows and persistent session storage. The wyzie-open-redeem IPC handler in index.js unconditionally strips all CSP response headers from a dedicated Electron session partition, and the redemption BrowserWindow omits a setWindowOpenHandler, compounding the attack surface. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions that must overlap in time: (1) the Streambert user must actively open the Wyzie API key redemption window by navigating to it in the application settings - passive users are not affected; and (2) attacker-controlled script content must be present in sub.wyzie.io or any page navigated to within that window, requiring the attacker to have achieved code injection on that specific third-party origin via supply-chain compromise, subdomain takeover, or a man-in-the-middle attack on the network path between the client and sub.wyzie.io. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N scoring 6.9 is well-calibrated for this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Streambert 2.6.0, available at https://github.com/truelockmc/streambert/releases/tag/2.6.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today