CVE-2026-67595 affects VaahCMS versions 2.0.0 through 2.3.4 by embedding a malicious obfuscated JavaScript payload within the Blade template responsible for rendering security OTP emails. When a user opens such an email in a browser with JavaScript enabled, the payload executes, establishing a WebSocket connection to a hardcoded command-and-control endpoint. It installs a MutationObserver-based keylogger targeting password input fields, scrapes DOM content from WhatsApp Web, and accepts remote commands to redirect or overwrite the page content. This enables remote attackers to execute unauthorized code and potentially steal sensitive information from affected users.

The vulnerability allows remote attackers to execute arbitrary JavaScript code in the context of the email rendered in a browser, leading to unauthorized data capture including password inputs and WhatsApp Web content. It also enables attackers to control the rendered page by redirecting or overwriting content. This can result in credential theft, privacy breaches, and further compromise of user systems. The CVSS 4.0 score of 9.2 reflects critical severity with network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid rendering security OTP emails from VaahCMS versions 2.0.0 through 2.3.4 in browsers with JavaScript enabled. Consider disabling JavaScript execution in email clients or using alternative secure methods to deliver OTPs. Monitor vendor channels for updates and apply official patches once released.