Is CVE-2026-9566 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9566 being exploited in the wild.

How severe is CVE-2026-9566?

Medium severity, with a CVSS score of 4.3, published 26 May 2026.

Is there a fix for CVE-2026-9566?

A patch was published on 2026-03-25: Fix merged into develop branch. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9566 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-9566?

Check whether you run Teable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9566: teableio Teable DOM XSS in LoginPage redirect parameter

CVE-2026-9566 · Severity: medium · CVSS 4.3 · Published 2026-05-26

Teable, an open-source no-code database platform, is vulnerable to a security flaw in its login and sign-up pages. An attacker can create a malicious link that, if clicked by a user who then logs in, executes unauthorized code in that user's browser. This could allow an attacker to steal sensitive data, hijack user sessions, or perform actions on the user's behalf without their knowledge.

Technologies: Teable. Vendors: Teable.

Quick answers

Is CVE-2026-9566 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9566 being exploited in the wild.
How severe is CVE-2026-9566?: Medium severity, with a CVSS score of 4.3, published 26 May 2026.
Which products and versions are affected?: Teable up to 1.9.x.
Is there a fix for CVE-2026-9566?: A patch was published on 2026-03-25: Fix merged into develop branch. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9566 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-9566?: Check whether you run Teable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in Teable's sign-in and sign-up functionality within 'apps/nextjs-app/src/features/auth/pages/LoginPage.tsx'. The application improperly handles the 'redirect' query parameter by passing it directly to Next.js 'router.push()' without sanitization. Because 'router.push()' can resolve 'javascript:' URIs to 'window.location', an attacker can execute arbitrary JavaScript in the victim's browser context. Exploitation requires the victim to click a crafted link and complete a fresh login session. Successful exploitation allows for session hijacking and unauthorized API requests. The issue is fixed in version release.2026-04-21T08-57-20Z.1513 by implementing 'isValidRedirectPath()' to block non-http(s) schemes and cross-origin redirects.

Affected products

teableio Teable up to 1.9.x

Timeline

2026-03-07: disclosed: Vulnerability reported to vendor via coordinated disclosure.
2026-03-25: patched: Fix merged into develop branch.
2026-04-21: advisory: Official release containing the fix published.
2026-05-26: other: CVE-2026-9566 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.