truelockmc Streambert up to 2.5.0 wyzie-open-redeem IPC handler index.js cross-domain policy

Summaryinfo

A vulnerability, which was classified as problematic, has been found in truelockmc Streambert up to 2.5.0. This impacts an unknown function of the file index.js of the component wyzie-open-redeem IPC handler. This manipulation causes cross-domain policy. This vulnerability is handled as CVE-2026-52873. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability has been found in truelockmc Streambert up to 2.5.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file index.js of the component wyzie-open-redeem IPC handler. The manipulation with an unknown input leads to a cross-domain policy vulnerability. The CWE definition for the vulnerability is CWE-942. The product uses a cross-domain policy file that includes domains that should not be trusted. As an impact it is known to affect confidentiality. The summary by CVE is:

Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until version 2.6.0, the wyzie-open-redeem IPC handler in index.js creates the partition:wyzie-redeem Electron session and registers an onHeadersReceived hook that removes the Content-Security-Policy header from every response in that session. The redeem window also lacks a setWindowOpenHandler restriction, so script injection in sub.wyzie.io, a loaded third-party resource, or a site reached through navigation executes without CSP constraints and can affect additional windows and persistent session storage. A user must open the Wyzie API key redemption window, and exploitation requires attacker-controlled script content in a loaded page. The resulting renderer script can invoke renderer-exposed application functionality and can be chained with other vulnerabilities to access internal services or sensitive data. This issue is fixed in version 2.6.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-52873 since 06/08/2026. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 2.6.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• truelockmc

Name

• Streambert

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5.0

Website

• Product: https://github.com/truelockmc/streambert/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion