CVE-2026-67595: VaahCMS RCE Vulnerability

CVE-2026-67595 Overview

CVE-2026-67595 affects VaahCMS versions 2.0.0 through 2.3.4, a Laravel-based headless content management system. The vulnerability stems from a malicious obfuscated JavaScript payload embedded in the Blade template that renders security one-time password (OTP) emails. Any browser that renders the affected email template with JavaScript enabled executes unauthorized code. The payload opens a WebSocket connection to a hardcoded command-and-control endpoint, installs a password-field keylogger using MutationObserver, scrapes WhatsApp Web DOM content, and accepts remote commands to redirect or overwrite the rendered page. The issue is classified as [CWE-506] Embedded Malicious Code and represents a supply chain compromise of the upstream VaahCMS package.

Critical Impact
Attackers control a hardcoded C2 endpoint that receives keystrokes, harvests session data from WhatsApp Web, and can hijack browser navigation for every user who renders an OTP email from an affected VaahCMS instance.

Affected Products

VaahCMS 2.0.0 through 2.3.4
webreinvent/vaahcms Composer package (versions prior to 2.3.5)
Applications using the security-otp.blade.php email template from affected releases

Discovery Timeline

2026-07-29 - CVE-2026-67595 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-67595

Vulnerability Analysis

The malicious code lives inside the Blade view that generates security OTP emails. When a recipient opens the email in a webmail client or browser context that executes JavaScript, the embedded payload runs with the privileges of the rendering origin. The payload performs four attacker-controlled actions in the victim browser.

First, it establishes a persistent WebSocket connection to a hardcoded command-and-control endpoint. Second, it installs a keylogger scoped to input[type=password] fields, using MutationObserver so that dynamically inserted password inputs are also captured. Third, it scrapes DOM content from WhatsApp Web sessions running in the same browser context. Fourth, it accepts commands from the C2 channel to redirect the page or replace the rendered DOM with attacker-supplied HTML.

Because the payload ships inside the official webreinvent/vaahcms package, this is a software supply chain incident rather than a runtime injection flaw. Every downstream deployment that pulled versions 2.0.0 through 2.3.4 inherited the malicious template.

Root Cause

The root cause is malicious code embedded directly in a distributed template file within the VaahCMS package. The fix was delivered in pull request #317 and shipped as version 2.3.5.

Attack Vector

Exploitation requires no authentication or user interaction beyond opening an OTP email from a vulnerable VaahCMS instance. The vector is network-based: the C2 WebSocket is contacted from every affected client browser, giving attackers passive access to credentials and active control over page content.

php

// Patch reference from Config/vaahcms.php
$settings =  [
    'app_name' => 'VaahCMS',
    'app_slug' => 'vaahcms',
-    'version' => '2.3.4',
+    'version' => '2.3.5',
    'php_version_required' => '8.1',
    'get_config_version' => false,
    'website' => 'https://vaah.dev/cms',
// Source: https://github.com/webreinvent/vaahcms/commit/8d7898f7a385a5fade1180a9b664ff158d873129

Detection Methods for CVE-2026-67595

Indicators of Compromise

Outbound WebSocket (ws:// or wss://) connections initiated from browsers immediately after rendering VaahCMS OTP emails.
Presence of obfuscated JavaScript inside resources/views/**/security-otp.blade.php or any Blade template shipped by webreinvent/vaahcms at versions 2.0.0 through 2.3.4.
composer.lock or composer.json entries pinning webreinvent/vaahcms to any version between 2.0.0 and 2.3.4 inclusive.
Unexpected DOM mutations or full-page redirects on internal apps rendered in browsers that also load WhatsApp Web.

Detection Strategies

Grep repositories and container images for the malicious script signature and for the OTP Blade template hash present in versions 2.0.0 through 2.3.4.
Inspect Software Bill of Materials (SBOM) output for webreinvent/vaahcms at vulnerable versions, then correlate with build pipelines.
Monitor proxy and DNS telemetry for browser-initiated WebSocket sessions to domains not previously reached by user agents.

Monitoring Recommendations

Alert on any egress WebSocket connection originating from browsers rendering internal mail or admin consoles.
Track modifications to files under the VaahCMS package directory in CI/CD and endpoint file-integrity monitors.
Log and review Content Security Policy (CSP) violation reports from mail rendering domains for unexpected script sources.

How to Mitigate CVE-2026-67595

Immediate Actions Required

Upgrade webreinvent/vaahcms to version 2.3.5 or later using composer update webreinvent/vaahcms.
Rotate credentials for any accounts that received OTP emails from affected VaahCMS instances, prioritizing administrator and service accounts.
Purge cached and queued OTP emails that were generated by vulnerable versions before they can be delivered.
Review browser and proxy logs for connections to the hardcoded C2 endpoint referenced in the VulnCheck Security Advisory.

Patch Information

The fix is available in VaahCMS 2.3.5. See the GitHub Commit Update and the GitHub Pull Request Discussion for the full change set. The patch removes the malicious payload from the security OTP Blade template and bumps the package version in Config/vaahcms.php and composer.json.

Workarounds

If immediate upgrade is not possible, replace the security-otp.blade.php template with a clean copy sourced from the 2.3.5 release before sending any further OTP emails.
Enforce a strict Content Security Policy on mail rendering surfaces that disallows inline scripts and WebSocket connections to untrusted origins.
Disable JavaScript execution in the mail client or webmail context used to view VaahCMS-generated messages until patching completes.

bash

# Configuration example - upgrade the vulnerable package
composer require webreinvent/vaahcms:^2.3.5
composer update webreinvent/vaahcms --with-dependencies

# Verify installed version
composer show webreinvent/vaahcms | grep versions