An attacker can extract user email addresses (PII) exposed in base64 encoding via the state parameter in the OAuth callback URL.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 20, 2026 · NIST NVD

   Detected

   An attacker can extract user email addresses (PII) exposed in base64 encoding via the state parameter in the OAuth callback URL.

2. Jun 17, 2026 · NIST NVD

   Updated

   An attacker can extract user email addresses (PII) exposed in base64 encoding via the state parameter in the OAuth callback URL.

Affected

• cpe gainsight/assistversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-31381

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-31381

  An attacker can extract user email addresses (PII) exposed in base64 encoding via the state parameter in the OAuth callback URL.

  nvd.nist.gov

References

• Third Party Advisory · rapid7.com
• Vendor Advisory · communities.gainsight.com