{"id":"CVE-2026-59788","published":"2026-10-05T11:17:00.113","lastModified":"2026-10-06T15:27:05.657","description":"The email media type OAuth form passes the Authorization endpoint value to window.open() without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who grants consent.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://support.zabbix.com/browse/ZBX-28198","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}