TI-2026-23943 CVE-2026-31381 · GHSA-r65g-h7vf-rvr5
Gainsight Assist plugin information disclosure
Priority LOW 30
An attacker can extract user email addresses (PII) exposed in base64 encoding via the state parameter in the OAuth callback URL.
Gainsight
Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9
Exploited now
Gainsight records in CISA KEVNo Gainsight vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
2 records in Assist · all components
TI-2026-23944 CVE-2026-31382 · GHSA-gg42-9683-x2xj
Gainsight Assist reflected XSS/HTML injection
Priority LOW 27
The error_description parameter is vulnerable to Reflected XSS.