Open Redirect in touchbase.ai
Priority LOW 28CWE-601Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-601.
Summary
touchbase.ai before version 2.0 is vulnerable to Open Redirect. Impacts can be many, and vary from theft of information and credentials, to the redirection to malicious websites containing attacker-controlled content, which in some cases even cause XSS attacks. So even though an open redirection might sound harmless at first, the impacts of it can be severe should it be exploitable. The issue is fixed in version 2.0.
Why it matters now
EPSS 0.00616 49th percentileScored 2026-11-07
Fix Fixed touchbase.ai (puncsky): 2.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
- Fix · CNA touchbase.ai (puncsky) Fixed in 2.0
Timeline
- 2026-10-02 Threatist record created from CVE-2020-26219
- 2026-10-03 Alias added: GHSA-gx8m-4376-pv8m
References
More puncsky Touchbase.ai vulnerabilities
- TI-2020-16039 HTML Injection in touchbase.ai CVSS 3.1HIGH 8.0
- TI-2020-16042 Stored Cross Site Scripting in touchbase.ai CVSS 3.1HIGH 8.0
- TI-2020-16041 Information exposure in touchbase.ai CVSS 3.1LOW 3.5
Sources
- CVE-2020-26219 · CVE Program
- CVE-2020-26219 · NVD
- FIRST EPSS
- GHSA-gx8m-4376-pv8m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences