CVE-2026-31381

Medium · 5.3

CVSS

5.3

EPSS

0.4%

Published

Mar 20, 2026

CISA due date

—

The record

An attacker can extract user email addresses (PII) exposed in base64 encoding via the state parameter in the OAuth callback URL.

Ecosystem	Package	Introduced	Fixed